## 4 Results
### Optimization of Metaparameters  
The lower bound of affinity matching must be calculated for each antibody to perform anomaly matching. Only those packets that the affinity is greater than the lower bound will be treated as an attack. Two types of antibody are taken as examples in Figure 11. In Figure 11a, whether the antibody belongs to a normal packet is identified. In Figure 11b, whether the antibody is attacking packet is detected. The red lines are the lower bounds of antibodies. When the affinity between the packet and antibody is greater than that of the lower bound (or the affinity lies on the right of the red line), the antibody manifests a receiving state. If the packet is only received by the antibody of a normal packet, as detected, then this packet can be determined to be a normal packet; otherwise, if the packet is only received by the antibody of an attack packet, as detected, then it is determined to be an attacking packet. If the packet is rejected simultaneously by normal and attacking antibodies, then it is an unknown packet. If the packet is received by more than two types of antibody, then it is a conflict packet. The details are illustrated in Table 7. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multicolumn{2}{c}{**Populations**} & \multicolumn{4}{c}{**5**} \\ \hline Population number & 1 & 2 & 3 & 4 & 5 \\ \hline Antibody sets in a population & 100 & 100 & 100 & 100 & 100 \\ \hline Migration interval & & & 100 & \\ \hline Random samples & & & 200 & \\ \hline Migration rate & & & 0.1 & \\ \hline Selection type & & & Threshold selection & \\ \hline Selection pressure & & & 1.7 & \\ \hline Reproduction rate & & & 0.1 & \\ \hline Cross-over rate & 0.3 & 0.4 & 0.5 & 0.6 & 0.7 \\ \hline Mutation rate & 0.02 & 0.05 & 0.02 & 0.05 & 0.02 \\ \hline Stopping criteria & & Stopped at 1500 th generation \\ \hline \hline \end{tabular}  
* Threshold = 1/selection pressure (SP); Antibody value = antibody affinity/max affinity in a population at a generation; For example, a particular antibody will be selected if it must surpass the threshold (1/1.7 = 0.588); antibody affinity = 100; max affinity in a population at a generation = 3000; 1000/3000 = 0.3 \(<\) 0.588; thus, this antibody will not be selected.  
\end{table} 
Table 6: Parameter setting in the IGA AIS. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Duration** & **Protocol Type** & **Service** & **Flag** & **Src Bytes** & **Land** & **Wrong Fragment** & **Uiggent** & **Hot** & **Label** \\ \hline
0 & udp & private & SF & 105 & 146 & 0 & 0 & 0 & 0 & normal \\ \hline
0 & udp & private & SF & 105 & 146 & 0 & 0 & 0 & 0 & smmpgetattack \\ \hline
0 & udp & domain & SF & 29 & 0 & 0 & 0 & 0 & 0 & normal \\ \hline
0 & tcp & private & SF & 105 & 146 & 0 & 0 & 0 & 0 & normal \\ \hline
0 & udp & private & SF & 105 & 146 & 0 & 0 & 0 & 0 & smmpgetattack \\ \hline
0 & tcp & http & SF & 223 & 185 & 0 & 0 & 0 & 0 & normal \\ \hline
0 & udp & private & SF & 105 & 146 & 0 & 0 & 0 & 0 & smmpgetattack \\ \hline
0 & tcp & http & SF & 230 & 260 & 0 & 0 & 0 & 0 & normal \\ \hline \hline \end{tabular}  
* Data source ([[http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html](http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html)]([http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html](http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html))).  
\end{table} 
Table 5: KDDCup data log. To find most fit lower bound of each antibody (i.e., the best position of the red line in Figure 8), each type of experimental factor is classified as three levels of 0.5, 1.0, and 1.5 standard deviations. Five antibodies in the center state adopt one level, whereas the other 12 antibodies have different levels. Hence, a total of 13 experimental factors exist, with 313 = 1,594,323 combinations in total. This study adopted the Taguchi method with an orthogonally designed array to reduce the number of tests in obtaining the desired result and determining the best level of each experimental factor [24]. The experiment needs 13 best levels in total.