Abstract
Artificial Immune Systems applied to network intrusion detection have been shown to perform relatively well detecting anomalies formed by connections timely and spatially clustered on small datasets. However, the performance of Artificial Immune Systems does not scale up well on large data sets, where anomalies are less likely to appear tightly clustered. In this work, we propose a collective detection with diversity activation method to detect anomalies that need not be spatially and timely clustered, aiming to improve the performance of AISs for network intrusion detection. In the proposed method, detectors are activated based on the diversity of connections that are able to match. In the detection stage, collectives of detectors are used to detect the anomalies. We conduct experiments with data obtained from a real network, verifying that the proposed method can improve detection rates of AISs significantly.
