# Interface Detector Based on Vaccination Strategy for Anomaly Detection

Authors: Yinghui Liu; Dong Li; Yuan Wei; Hongli Zhang
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

Interface detector is an enhanced negative selection algorithm with online adaptive learning under small training samples for anomaly detection. It has better detection performance when it has an appropriate self-radius. Otherwise, overfitting or underfitting would occur. In the present paper, an improved interface detector, which is based on vaccination strategy, is proposed. During the testing stage, negative vaccine can overcome overfitting to improve the detection rate and positive vaccine can overcome underfitting to reduce the false alarm rate. The experimental results show that under the same dataset, self-radius, and training samples condition, the detection rate of the interface detector with negative vaccine is much higher than that of interface detector, SVM, and BP neural network. Moreover, the false alarm rate of the interface detector with positive vaccine is much lower than that of the interface detector and PSA.


---

## Body

## 1. Introduction

Negative selection algorithm (NSA), which was proposed by Forrest et al. in 1994 [1], is a significant algorithm of artificial immune systems. It is inspired by the mechanism of T-cell maturation that happens in the thymus, attracting widespread interest in the field of anomaly detection and fault diagnosis [2–7].The initial NSA defines self-samples and nonself-samples using binary strings [3], making it easy to understand the mechanism of NSA. Soon, a real-valued NSA was presented [8], since many application problems can be described in real-valued space. At first, it uses constant size hypersphere as detectors. Later, the other detectors were proposed, such as variable-sized detector [9], hypercube detector [10], hyperellipsoid detector [11], and multishaped detector [12].To improve the detection rate and reduce the amount of detectors, some improved NSA algorithms were proposed. Boundary detectors [13] are allowed to cover a part of self-space, making themselves enable to eliminate the holes on the boundary and have an opportunity to detect the deceiving anomalies hidden in the self-space. Furthermore, training negative selection algorithm (FtNSA) [14] generates V-detectors in self-space and nonself-space, respectively, and it can classify the testing samples lying within the holes. Self-adaptive negative selection algorithm (ANSA) [15] can build an appropriate profile of the system by using a subset of self-samples and adaptively adjust the self-radius, the detection radius, and number of detectors to amend the built profile of the system. It can adapt the varieties of self-/nonself-space.Although the methods mentioned above can improve the detection rate or reduce the quality of detectors, little attention has been paid to the detector with online adaptive learning. Interface detector [16–18] is based on the outer layer samples of self-space, which is one or more closed hyperspheres (shown in Figure 1). It can be built under small training samples, and sometimes, one sample is enough. It can adapt itself to real-time variety of self-space during the testing stage. It can completely surround the self-space with an appropriate self-radius, making self-samples inside of it and nonself-samples outside of it.Figure 1
Interface detector of different datasets.
(a)(b)(c)(d)The learning ability of the interface detector depends on the self-radiusrs. Once rs is relatively large, the interface detector would classify a nonself-sample as a boundary sample, and then, overfitting can occur, leading to the detection rate decrease. Once rs is relatively small, the interface detector cannot surround all the self-spaces, and then, underfitting occurs, leading to the false alarm rate increase.The purpose of the present work is to further improve the detection performance of the interface detector by introducing vaccination strategy. As in the immune system, vaccination can generate a strong immune response, providing long-term protection against infection [19–21]. So some samples whose classifications are known can be used as vaccines to improve the learning ability of the interface detector.


## 2. Overfitting of the Interface Detector and Negative Vaccine

When the minimum distancedo between self-samples and nonself-samples is smaller than rs, overfitting occurs.Figure2 shows the overfitting process of the interface detector on 2-dimensional synthetic dataset. There are 3 self-samples and 2 nonself-samples (t1, t2, t3 ∈ S; t4, t5 ∈ N). Select t2 as the training sample and others as testing samples; the testing sequence is t3, t4, t1, and t5 (shown in Figure 2(a)). The interface detector built by t2 (shown in Figure 2(b)) recognizes t3 ∈ S and t3 ∈ B (right). The new interface detector built by t2 and t3 (shown in Figure 2(c)) recognizes t4 ∈ S and t4 ∈ B (wrong), for d34 < rs, where d34 is the distance between t3 and t4.Figure 2
Overfitting process of the interface detector.
(a)(b)(c)(d)(e)(f)The new interface detector built byt2, t3, and t4 (shown in Figure 2(d)) recognizes t1 ∈ S and t1 ∈ B (right). When the new interface detector built by t2, t3, t4, and t1 (shown in Figure 2(e)) recognizes t5 ∈ S and t5 ∈ B (wrong), overfitting occurs. Because nonself-sample t4 is wrongly recognized as a boundary sample, the new interface detector built by boundary samples which include t4 can wrongly recognize other nonself-samples such as t5. When t5 is wrongly recognized as a boundary sample, the interface detector built by these boundary samples (shown in Figure 2(f)) can enhance overfitting, leading to the rapid decrease in the detection rate.Taking a smallrs (d34 > rs) is a way to avoid overfitting of the interface detector, but once rs is relatively small, other new problems will appear [16]. Negative vaccine can balance this problem without modifying rs.That a testing samplet is recognized as a boundary sample is determined by the position information of the nearest boundary sample to t, rather than the others [16]. Negative vaccines are nonself-samples, and they can revise the position information of the boundary samples, which are recognized as new ones during the training stage or testing stage. Figure 3 shows the progress of negative vaccine adjusting the interface detector on the 2-dimensional synthetic dataset.Figure 3
The process of the interface detector with negative vaccine.
(a)(b)(c)(d)That the interface detector built byt2 and t3 wrongly recognizes t4 as a boundary sample is determined by the position information of t3. If t4 is considered as a negative vaccine (shown in Figure 3(a)), it revises the position information of t3. The interface detector built by t2 and t3 adjusts itself to be what is shown in Figure 3(b). The new interface detector recognizes t1 ∈ S and t1 ∈ B (shown in Figure 3(c)). t1 adjusts the interface detector as is shown in Figure 3(d). The new interface detector recognizes t5 ∈ N, and overfitting does not occur.


## 3. Underfitting of the Interface Detector and Positive Vaccine

Whenrs is relatively small, the interface detector cannot recognize other new boundary samples to adjust itself. As a result, the interface detector cannot surround all the self-spaces and underfitting occurs.Figure4 shows the underfitting process of the interface detector on the 2-dimensional synthetic dataset. There are 5 self-samples. Select t2 as the training sample and others as testing samples; testing sequence is t3, t4, t1, and t5 (shown in Figure 4(a)). The interface detector built by t2 (shown in Figure 4(b)) recognizes t3 ∈ S and t3 ∈ B (right). The new interface detector built by t2 and t3 (shown in Figure 4(c)) recognizes t4 ∈ N (wrong), for d34 > rs, where d34 is the distance between t3 and t4. It recognizes t1 ∈ S and t1 ∈ B (right) (shown in Figure 4(d)). The interface detector is adjusted by t1 to be what is shown in Figure 4(e). It recognizes t5 ∈ N (wrong), and underfitting occurs (shown in Figure 4(f)). Because rs is relatively small, the interface detector cannot completely surround self-space.Figure 4
Underfitting process of the interface detector.
(a)(b)(c)(d)(e)(f)Taking a largers (d34 < rs) is a way to avoid underfitting of the interface detector, but once rs is relatively large, other new problems will appear [16]. Positive vaccine can balance this problem without modifying rs.Positive vaccines are new boundary samples, and they can adjust the interface detector to surround more self-space. Figure5 shows the progress of positive vaccine adjusting the interface detector on the 2-dimensional synthetic dataset. Figure 4(f) shows that the interface detector built by t1, t2, and t3 wrongly recognizes t4 ∈ N and t5 ∈ N. Assume t5 as a positive vaccine (shown in Figure 5(a)), and interface detector is adjusted by t5 to be what is shown in Figure 5(b). It recognizes t4 ∈ S and t4 ∈ B (right). At last, the interface detector completely surrounds the self-space (shown in Figure 5(c)).Figure 5
The process of the interface detector with positive vaccine.
(a)(b)(c)


## 4. Experiment and Results

Interface detector based on vaccination strategy is used to overcome these problems. Because the interface detector based on vaccination strategy can adapt itself to real-time variety of self-space by continual learning of the testing samples during the testing stage.In order to determine the performance and possible advantages of our proposed approach, we performed the experiments with 2-dimensional synthetic datasets (shown in Figures6(a) and 7(a)). The algorithm of the interface detector based on vaccination strategy is shown in Figure 8.Figure 6
The detection performance of the interface detector with negative vaccine.
(a)(b)(c)Figure 7
The detection performance of the interface detector with positive vaccine.
(a)(b)(c)(d)Figure 8
Flow chart of the interface detector based on vaccination strategy during the testing stage.


### 4.1. Interface Detector with Negative Vaccine

To determine the advantages of the interface detector with negative vaccine, the comparison of interface detector, support vector machine (SVM), and BP neural network is carried out on a 2-dimensional synthetic dataset (shown in Figure6(a)), in which there are 81 self-samples and 81 nonself-samples.


#### 4.1.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1, and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector adapts itself during the testing stage to be what is shown in Figure6(b) finally. The detection rate is 0%, and the false alarm rate is 0%.Because the minimum distance between self-samples and nonself-samples is shorter thanrs, the interface detector wrongly recognizes a nonself-sample as a boundary sample, leading to overfitting. At last, the interface detector not only surrounds all the self-spaces but also surrounds all the nonself-space.


#### 4.1.2. Results of the Interface Detector with Negative Vaccine

Negative vaccine can be used to overcome overfitting of the interface detector and improve the detection rate. For this problem, select the nonself-sample which is nearest to self-samples as negative vaccine (shown in Figure6(c)).Randomly select one self-sample as the training sample and others as testing samples, except negative vaccine. The interface detector with negative vaccine improves the detection rate up to 100%, but the false alarm rate is still 0%. Finally, the interface detector is shown in Figure6(c).Compared with the results of SVM and BP neural network shown in Table1, the interface detector with negative vaccine has better detection performance than that of the others.Table 1
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector00Interface detector with negative vaccine1000SVM with default parameters10024.37BP neural network with 5 concealed layer nodes97.7320.35In SVM and BP neural network, randomly select one self-sample and the nonself-sample which is the negative vaccine as training samples and others as testing samples. The results are average of 81 repeated experiments, for every self-sample takes turns as training data.


### 4.2. Interface Detector with Positive Vaccine

To determine the advantages of the interface detector with positive vaccine, the comparison of the interface detector and positive selection algorithm (PSA) is carried out on a 2-dimensional synthetic dataset (shown in Figure7(a)), in which there are 136 self-samples and 213 nonself-samples. S=S1∪S2, and there are 68 samples in S1 and S2, respectively.


#### 4.2.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1 and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector can adapts itself during the testing stage to be what is shown in Figures7(b) and 7(c) finally. The detection rate is 100%, and the false alarm rate is 50%.Because the minimum distance between self-samples and nonself-samples is larger thanrs, the interface detector cannot surround any nonself-space. Because minimum distance between S1 and S2 is larger than rs, the interface detector cannot recognize any other new boundary samples to adapt itself to completely surrounding all the self-spaces. At last, the interface detector only surrounds half of the self-space.


#### 4.2.2. Results of the Interface Detector with Positive Vaccine

Positive vaccine can be used to overcome underfitting and reducing the false alarm rate of the interface detector.Randomly select one sample inS1 and one sample is S2 as the training sample and positive vaccine and others as testing samples. The interface detector with positive vaccine reduces the false alarm rate down to 0%, but the detection rate is still 100%. At last, the interface detector is shown in Figure 7(d).Compared with the results of the positive selection algorithm (PSA) shown in Table2, the interface detector with positive vaccine has better detection performance than PSA.Table 2
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector10050Interface detector with positive vaccine1000PSA10098.07In PSA, the radius of detectors is the same asrs. Randomly select one sample in S1 and S2, respectively, as training samples and others as testing samples. The results are the average of 4624 repeated experiments, for every self-sample takes turns as training data.The interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage.Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. The positive vaccines are the self-samples and are easy to get. So this method has better anomaly detection performance, whether the experiment is conducted on synthetic datasets or standard datasets.Overfitting of the interface detector is overcome by negative vaccine, which improve the detection rate. The negative vaccines are nonself-samples and are difficult to get. How to get the negative vaccines efficiently is the next work to do.


## 4.1. Interface Detector with Negative Vaccine

To determine the advantages of the interface detector with negative vaccine, the comparison of interface detector, support vector machine (SVM), and BP neural network is carried out on a 2-dimensional synthetic dataset (shown in Figure6(a)), in which there are 81 self-samples and 81 nonself-samples.


### 4.1.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1, and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector adapts itself during the testing stage to be what is shown in Figure6(b) finally. The detection rate is 0%, and the false alarm rate is 0%.Because the minimum distance between self-samples and nonself-samples is shorter thanrs, the interface detector wrongly recognizes a nonself-sample as a boundary sample, leading to overfitting. At last, the interface detector not only surrounds all the self-spaces but also surrounds all the nonself-space.


### 4.1.2. Results of the Interface Detector with Negative Vaccine

Negative vaccine can be used to overcome overfitting of the interface detector and improve the detection rate. For this problem, select the nonself-sample which is nearest to self-samples as negative vaccine (shown in Figure6(c)).Randomly select one self-sample as the training sample and others as testing samples, except negative vaccine. The interface detector with negative vaccine improves the detection rate up to 100%, but the false alarm rate is still 0%. Finally, the interface detector is shown in Figure6(c).Compared with the results of SVM and BP neural network shown in Table1, the interface detector with negative vaccine has better detection performance than that of the others.Table 1
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector00Interface detector with negative vaccine1000SVM with default parameters10024.37BP neural network with 5 concealed layer nodes97.7320.35In SVM and BP neural network, randomly select one self-sample and the nonself-sample which is the negative vaccine as training samples and others as testing samples. The results are average of 81 repeated experiments, for every self-sample takes turns as training data.


## 4.1.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1, and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector adapts itself during the testing stage to be what is shown in Figure6(b) finally. The detection rate is 0%, and the false alarm rate is 0%.Because the minimum distance between self-samples and nonself-samples is shorter thanrs, the interface detector wrongly recognizes a nonself-sample as a boundary sample, leading to overfitting. At last, the interface detector not only surrounds all the self-spaces but also surrounds all the nonself-space.


## 4.1.2. Results of the Interface Detector with Negative Vaccine

Negative vaccine can be used to overcome overfitting of the interface detector and improve the detection rate. For this problem, select the nonself-sample which is nearest to self-samples as negative vaccine (shown in Figure6(c)).Randomly select one self-sample as the training sample and others as testing samples, except negative vaccine. The interface detector with negative vaccine improves the detection rate up to 100%, but the false alarm rate is still 0%. Finally, the interface detector is shown in Figure6(c).Compared with the results of SVM and BP neural network shown in Table1, the interface detector with negative vaccine has better detection performance than that of the others.Table 1
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector00Interface detector with negative vaccine1000SVM with default parameters10024.37BP neural network with 5 concealed layer nodes97.7320.35In SVM and BP neural network, randomly select one self-sample and the nonself-sample which is the negative vaccine as training samples and others as testing samples. The results are average of 81 repeated experiments, for every self-sample takes turns as training data.


## 4.2. Interface Detector with Positive Vaccine

To determine the advantages of the interface detector with positive vaccine, the comparison of the interface detector and positive selection algorithm (PSA) is carried out on a 2-dimensional synthetic dataset (shown in Figure7(a)), in which there are 136 self-samples and 213 nonself-samples. S=S1∪S2, and there are 68 samples in S1 and S2, respectively.


### 4.2.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1 and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector can adapts itself during the testing stage to be what is shown in Figures7(b) and 7(c) finally. The detection rate is 100%, and the false alarm rate is 50%.Because the minimum distance between self-samples and nonself-samples is larger thanrs, the interface detector cannot surround any nonself-space. Because minimum distance between S1 and S2 is larger than rs, the interface detector cannot recognize any other new boundary samples to adapt itself to completely surrounding all the self-spaces. At last, the interface detector only surrounds half of the self-space.


### 4.2.2. Results of the Interface Detector with Positive Vaccine

Positive vaccine can be used to overcome underfitting and reducing the false alarm rate of the interface detector.Randomly select one sample inS1 and one sample is S2 as the training sample and positive vaccine and others as testing samples. The interface detector with positive vaccine reduces the false alarm rate down to 0%, but the detection rate is still 100%. At last, the interface detector is shown in Figure 7(d).Compared with the results of the positive selection algorithm (PSA) shown in Table2, the interface detector with positive vaccine has better detection performance than PSA.Table 2
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector10050Interface detector with positive vaccine1000PSA10098.07In PSA, the radius of detectors is the same asrs. Randomly select one sample in S1 and S2, respectively, as training samples and others as testing samples. The results are the average of 4624 repeated experiments, for every self-sample takes turns as training data.The interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage.Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. The positive vaccines are the self-samples and are easy to get. So this method has better anomaly detection performance, whether the experiment is conducted on synthetic datasets or standard datasets.Overfitting of the interface detector is overcome by negative vaccine, which improve the detection rate. The negative vaccines are nonself-samples and are difficult to get. How to get the negative vaccines efficiently is the next work to do.


## 4.2.1. Results of the Interface Detector

Takers=maxd, where d=mind12,d13,d14,…,d1k,mind21,d23,d24,…,d2k,…,mindk1,dk2,dk3,…dkk−1 and dij is the distance between si and sj.Randomly select one self-sample as the training sample and others as testing samples. The interface detector can adapts itself during the testing stage to be what is shown in Figures7(b) and 7(c) finally. The detection rate is 100%, and the false alarm rate is 50%.Because the minimum distance between self-samples and nonself-samples is larger thanrs, the interface detector cannot surround any nonself-space. Because minimum distance between S1 and S2 is larger than rs, the interface detector cannot recognize any other new boundary samples to adapt itself to completely surrounding all the self-spaces. At last, the interface detector only surrounds half of the self-space.


## 4.2.2. Results of the Interface Detector with Positive Vaccine

Positive vaccine can be used to overcome underfitting and reducing the false alarm rate of the interface detector.Randomly select one sample inS1 and one sample is S2 as the training sample and positive vaccine and others as testing samples. The interface detector with positive vaccine reduces the false alarm rate down to 0%, but the detection rate is still 100%. At last, the interface detector is shown in Figure 7(d).Compared with the results of the positive selection algorithm (PSA) shown in Table2, the interface detector with positive vaccine has better detection performance than PSA.Table 2
Detection performance of different algorithms.
Detection rate (%)False alarm rate (%)Interface detector10050Interface detector with positive vaccine1000PSA10098.07In PSA, the radius of detectors is the same asrs. Randomly select one sample in S1 and S2, respectively, as training samples and others as testing samples. The results are the average of 4624 repeated experiments, for every self-sample takes turns as training data.The interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage.Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. The positive vaccines are the self-samples and are easy to get. So this method has better anomaly detection performance, whether the experiment is conducted on synthetic datasets or standard datasets.Overfitting of the interface detector is overcome by negative vaccine, which improve the detection rate. The negative vaccines are nonself-samples and are difficult to get. How to get the negative vaccines efficiently is the next work to do.


## 5. Conclusions

A modified interface detector is developed by introducing vaccination strategy in this work. Interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage. Overfitting of the interface detector is overcome by negative vaccine, and it can improve the detection rate. Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. Comprehensive experimental results demonstrate that the proposed method is effective in anomaly detection. Under the same dataset, self-radius, and training samples condition, the detection rate of the interface detector with negative vaccine is much higher than that of interface detector, SVM, and BP neural network. In addition, the false alarm rate of the interface detector with positive vaccine is much lower than that of the interface detector and PSA.The interface detector based on vaccination strategy can adapt itself to real-time variety of self-space by continual learning of the testing samples during the testing stage. This paper does not consider the computational complexity. We are preparing to do experiment with actual fault data in the future, and the computational complexity will be considered.



---

*Source: 2106576-2020-07-26.xml*