Interface Detector Based on Vaccination Strategy for Anomaly Detection

Interface detector is an enhanced negative selection algorithm with online adaptive learning under small training samples for anomaly detection. It has better detection performance when it has an appropriate self-radius. Otherwise, overfitting or underfitting would occur. In the present paper, an improved interface detector, which is based on vaccination strategy, is proposed. During the testing stage, negative vaccine can overcome overfitting to improve the detection rate and positive vaccine can overcome underfitting to reduce the false alarm rate. -e experimental results show that under the same dataset, self-radius, and training samples condition, the detection rate of the interface detector with negative vaccine is much higher than that of interface detector, SVM, and BP neural network. Moreover, the false alarm rate of the interface detector with positive vaccine is much lower than that of the interface detector and PSA.


Introduction
Negative selection algorithm (NSA), which was proposed by Forrest et al. in 1994 [1], is a significant algorithm of artificial immune systems. It is inspired by the mechanism of T-cell maturation that happens in the thymus, attracting widespread interest in the field of anomaly detection and fault diagnosis [2][3][4][5][6][7]. e initial NSA defines self-samples and nonself-samples using binary strings [3], making it easy to understand the mechanism of NSA. Soon, a real-valued NSA was presented [8], since many application problems can be described in real-valued space. At first, it uses constant size hypersphere as detectors. Later, the other detectors were proposed, such as variable-sized detector [9], hypercube detector [10], hyperellipsoid detector [11], and multishaped detector [12].
To improve the detection rate and reduce the amount of detectors, some improved NSA algorithms were proposed. Boundary detectors [13] are allowed to cover a part of selfspace, making themselves enable to eliminate the holes on the boundary and have an opportunity to detect the deceiving anomalies hidden in the self-space. Furthermore, training negative selection algorithm (FtNSA) [14] generates V-detectors in self-space and nonself-space, respectively, and it can classify the testing samples lying within the holes. Self-adaptive negative selection algorithm (ANSA) [15] can build an appropriate profile of the system by using a subset of self-samples and adaptively adjust the self-radius, the detection radius, and number of detectors to amend the built profile of the system. It can adapt the varieties of self-/ nonself-space.
Although the methods mentioned above can improve the detection rate or reduce the quality of detectors, little attention has been paid to the detector with online adaptive learning. Interface detector [16][17][18] is based on the outer layer samples of self-space, which is one or more closed hyperspheres (shown in Figure 1). It can be built under small training samples, and sometimes, one sample is enough. It can adapt itself to real-time variety of self-space during the testing stage. It can completely surround the self-space with an appropriate self-radius, making self-samples inside of it and nonself-samples outside of it. e learning ability of the interface detector depends on the self-radius r s . Once r s is relatively large, the interface detector would classify a nonself-sample as a boundary sample, and then, overfitting can occur, leading to the detection rate decrease. Once r s is relatively small, the interface detector cannot surround all the self-spaces, and then, underfitting occurs, leading to the false alarm rate increase. e purpose of the present work is to further improve the detection performance of the interface detector by introducing vaccination strategy. As in the immune system, Nonself-sample Self-sample Boundary sample    Mathematical Problems in Engineering vaccination can generate a strong immune response, providing long-term protection against infection [19][20][21]. So some samples whose classifications are known can be used as vaccines to improve the learning ability of the interface detector.

Overfitting of the Interface Detector and Negative Vaccine
When the minimum distance d o between self-samples and nonself-samples is smaller than r s , overfitting occurs. Figure 2 shows the overfitting process of the interface detector on 2-dimensional synthetic dataset. ere are 3 selfsamples and 2 nonself-samples (t 1 , t 2 , t 3 ∈ S; t 4 , t 5 ∈ N). Select t 2 as the training sample and others as testing samples; the testing sequence is t 3 , t 4 , t 1 , and t 5 (shown in Figure 2(a)). e interface detector built by t 2 (shown in Figure 2(b)) recognizes t 3 ∈ S and t 3 ∈ B (right). e new interface detector built by t 2 and t 3 (shown in Figure 2(c)) recognizes t 4 ∈ S and t 4 ∈ B (wrong), for d 34 < r s , where d 34 is the distance between t 3 and t 4 .
e new interface detector built by t 2 , t 3 , and t 4 (shown in Figure 2(d)) recognizes t 1 ∈ S and t 1 ∈ B (right). When the new interface detector built by t 2 , t 3 , t 4 , and t 1 (shown in Figure 2(e)) recognizes t 5 ∈ S and t 5 ∈ B (wrong), overfitting occurs. Because nonself-sample t 4 is wrongly recognized as a boundary sample, the new interface detector built by boundary samples which include t 4 can wrongly recognize other nonselfsamples such as t 5 . When t 5 is wrongly recognized as a boundary sample, the interface detector built by these boundary samples (shown in Figure 2(f)) can enhance overfitting, leading to the rapid decrease in the detection rate.
Taking a small r s (d 34 > r s ) is a way to avoid overfitting of the interface detector, but once r s is relatively small, other new problems will appear [16]. Negative vaccine can balance this problem without modifying r s . at a testing sample t is recognized as a boundary sample is determined by the position information of the nearest boundary sample to t, rather than the others [16]. Negative vaccines are nonself-samples, and they can revise the position information of the boundary samples, which are recognized as new ones during the training stage or testing stage. Figure 3 shows the progress of negative vaccine adjusting the interface detector on the 2-dimensional synthetic dataset.
at the interface detector built by t 2 and t 3 wrongly recognizes t 4 as a boundary sample is determined by the position information of t 3 . If t 4 is considered as a negative vaccine (shown in Figure 3(a)), it revises the position information of t 3 . e interface detector built by t 2 and t 3 adjusts itself to be what is shown in Figure 3(b). e new interface detector recognizes t 1 ∈ S and t 1 ∈ B (shown in Figure 3(c)). t 1 adjusts the interface detector as is shown in Figure 3(d). e new interface detector recognizes t 5 ∈ N, and overfitting does not occur.

Underfitting of the Interface Detector and Positive Vaccine
When r s is relatively small, the interface detector cannot recognize other new boundary samples to adjust itself. As a result, the interface detector cannot surround all the selfspaces and underfitting occurs.  Figure 4 shows the underfitting process of the interface detector on the 2-dimensional synthetic dataset. ere are 5 self-samples. Select t 2 as the training sample and others as testing samples; testing sequence is t 3 , t 4 , t 1 , and t 5 (shown in Figure 4(a)). e interface detector built by t 2 (shown in Figure 4(b)) recognizes t 3 ∈ S and t 3 ∈ B (right). e new interface detector built by t 2 and t 3 (shown in Figure 4(c)) recognizes t 4 ∈ N (wrong), for d 34 > r s , where d 34 is the distance between t 3 and t 4 . It recognizes t 1 ∈ S and t 1 ∈ B (right) (shown in Figure 4(d)). e interface detector is Negative vaccine   Figure 4(e). It recognizes t 5 ∈ N (wrong), and underfitting occurs (shown in Figure 4(f )). Because r s is relatively small, the interface detector cannot completely surround self-space. Taking a large r s (d 34 < r s ) is a way to avoid underfitting of the interface detector, but once r s is relatively large, other new problems will appear [16]. Positive vaccine can balance this problem without modifying r s .
Positive vaccines are new boundary samples, and they can adjust the interface detector to surround more selfspace. Figure 5 shows the progress of positive vaccine adjusting the interface detector on the 2-dimensional synthetic dataset. Figure 4(f ) shows that the interface detector built by t 1 , t 2 , and t 3 wrongly recognizes t 4 ∈ N and t 5 ∈ N. Assume t 5 as a positive vaccine (shown in Figure 5(a)), and interface detector is adjusted by t 5 to be what is shown in Figure 5(b). It recognizes t 4 ∈ S and t 4 ∈ B (right). At last, the interface detector completely surrounds the self-space (shown in Figure 5(c)).

Experiment and Results
Interface detector based on vaccination strategy is used to overcome these problems. Because the interface detector based on vaccination strategy can adapt itself to real-time variety of self-space by continual learning of the testing samples during the testing stage.
In order to determine the performance and possible advantages of our proposed approach, we performed the experiments with 2-dimensional synthetic datasets (shown in Figures 6(a) and 7(a)). e algorithm of the interface detector based on vaccination strategy is shown in Figure 8.

Interface Detector with Negative Vaccine.
To determine the advantages of the interface detector with negative vaccine, the comparison of interface detector, support vector machine (SVM), and BP neural network is carried out on a 2-dimensional synthetic dataset (shown in Figure 6(a)), in which there are 81 self-samples and 81 nonself-samples. Randomly select one self-sample as the training sample and others as testing samples. e interface detector adapts itself during the testing stage to be what is shown in Figure 6(b) finally. e detection rate is 0%, and the false alarm rate is 0%. Because the minimum distance between self-samples and nonself-samples is shorter than r s , the interface detector wrongly recognizes a nonself-sample as a boundary sample, leading to overfitting. At last, the interface detector not only surrounds all the self-spaces but also surrounds all the nonself-space.

Results of the Interface Detector with Negative Vaccine.
Negative vaccine can be used to overcome overfitting of the interface detector and improve the detection rate. For this problem, select the nonself-sample which is nearest to selfsamples as negative vaccine (shown in Figure 6(c)).
Randomly select one self-sample as the training sample and others as testing samples, except negative vaccine. e interface detector with negative vaccine improves the Mathematical Problems in Engineering detection rate up to 100%, but the false alarm rate is still 0%. Finally, the interface detector is shown in Figure 6(c). Compared with the results of SVM and BP neural network shown in Table 1, the interface detector with negative vaccine has better detection performance than that of the others.
In SVM and BP neural network, randomly select one self-sample and the nonself-sample which is the negative vaccine as training samples and others as testing samples.
Randomly select one self-sample as the training sample and others as testing samples. e interface detector can adapts itself during the testing stage to be what is shown in Mathematical Problems in Engineering Figures 7(b) and 7(c) finally. e detection rate is 100%, and the false alarm rate is 50%. Because the minimum distance between self-samples and nonself-samples is larger than r s , the interface detector cannot surround any nonself-space. Because minimum distance between S 1 and S 2 is larger than r s , the interface detector cannot recognize any other new boundary samples to adapt itself to completely surrounding all the self-spaces. At last, the interface detector only surrounds half of the selfspace.

Results of the Interface Detector with Positive Vaccine.
Positive vaccine can be used to overcome underfitting and reducing the false alarm rate of the interface detector.
Randomly select one sample in S 1 and one sample is S 2 as the training sample and positive vaccine and others as testing samples. e interface detector with positive vaccine reduces the false alarm rate down to 0%, but the detection rate is still 100%. At last, the interface detector is shown in Figure 7(d).
Compared with the results of the positive selection algorithm (PSA) shown in Table 2, the interface detector with positive vaccine has better detection performance than PSA.
In PSA, the radius of detectors is the same as r s . Randomly select one sample in S 1 and S 2 , respectively, as training samples and others as testing samples. e results are the average of 4624 repeated experiments, for every selfsample takes turns as training data. e interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage.
Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. e positive vaccines are the self-samples and are easy to get. So this method has better anomaly detection performance,   whether the experiment is conducted on synthetic datasets or standard datasets.
Overfitting of the interface detector is overcome by negative vaccine, which improve the detection rate. e negative vaccines are nonself-samples and are difficult to get. How to get the negative vaccines efficiently is the next work to do.

Conclusions
A modified interface detector is developed by introducing vaccination strategy in this work. Interface detector based on vaccination strategy can overcome the drawbacks of the interface detector during the testing stage. Overfitting of the interface detector is overcome by negative vaccine, and it can improve the detection rate. Underfitting of the interface detector is overcome by positive vaccine, which reduces the false alarm rate. Comprehensive experimental results demonstrate that the proposed method is effective in anomaly detection. Under the same dataset, self-radius, and training samples condition, the detection rate of the interface detector with negative vaccine is much higher than that of interface detector, SVM, and BP neural network. In addition, the false alarm rate of the interface detector with positive vaccine is much lower than that of the interface detector and PSA. e interface detector based on vaccination strategy can adapt itself to real-time variety of self-space by continual learning of the testing samples during the testing stage. is paper does not consider the computational complexity. We are preparing to do experiment with actual fault data in the future, and the computational complexity will be considered.

and t 5 :
Nonself-samples d 34 : e distance between t 3 and t 4 t: A testing sample s i : A single self-sample d ij : e distance between s i and s j S: e set of self-samples B: e set of boundary samples N: e set of nonself-samples P: e set of samples position.

Data Availability
e data used to support the findings of this study are included within the article.

Conflicts of Interest
e authors declare that there are no conflicts of interest regarding the publication of this paper.