## 1 Introduction
### Algorithmic Process  
In the NSA, detectors are generated randomly and tested against a set of self-samples. Detectors that match the self-samples are discarded, while those that do not match are retained. These retained detectors are then used to monitor the system for anomalous patterns. Formally, the process can be represented as follows:  
* Randomly generate candidate detectors.
* Compare each detector, \(d_{i}\), with the self-set, \(S\), such that \(S=\{s_{1},s_{2},...,s_{n}\}\).
* If a detector, \(d_{i}\), matches any self-sample, \(s_{j}\in S\), discard \(d_{i}\).
* Retain the detectors that do not match any self-sample for anomaly detection.  
The analogy to T-cell generation in the immune system is direct. Just as immature T-cells that recognize self-antigens are removed to prevent autoimmune reactions, the NSA removes detectors that match the normal (self) data. The remaining detectors are akin to mature T-cells, which are ready to identify anomalies (non-self) in the system [39].  
The NSA is considered a semi-supervised learning algorithm because it requires a set of normal (self) data for training but does not require labeled anomalous data. This makes it suitable for applications where it is easy to obtain normal data but difficult or costly to gather labeled anomalies.  
One common approach in the NSA is the generation of spherical detectors, where the detectors are represented as hyperspheres in the data space. Each detector can be defined by its center, \(c\), and radius, \(r\). The detector classifies a data point, \(x\), as anomalous if it falls inside the hypersphere:  
\[\text{Anomaly if:}\quad||x-c||<r\]  
This method allows for a flexible representation of normal data and can be computationally efficient when implemented in high-dimensional spaces [40; 41].  
As presented above, the Negative Selection Algorithm (NSA) in its basic form has found many applications. Many improvements to the original approach have also been developed. This work does not aim to present an exhaustive literature review. Interested readers can be directed to the following references as good starting points for analyzing the topic. In [42], the application of feature detection rules in the NSA is presented, which allows for anomaly identification using feature matching functions, thereby increasing detection effectiveness. In [43], improvements to the classical negative selection algorithm and its application in Intrusion Detection Systems (IDSs) are discussed. It includes a review of works combining the algorithm with security systems. In [44], the use of the NSA in combination with classification techniques for process anomaly detection is presented. It focuses on the adaptive aspects of the NSA in dynamic environments. In [45], a new fault diagnosis method using a modified NSA is developed, taking into account changing conditions in industrial processes.  
It is important to highlight that the unsupervised anomaly detection approach proposed in this study is based on the referenced works but does not directly compete with these methods, because the NSA was originally developed for the purposes of semi-supervised anomaly detection.