Intelligent Database Systems Lab 國立雲林科技大學 National Yunlin University of Science and Technology 2005.ACM GECCO.8.Discriminating and visualizing anomalies using negative selection and self-organizing maps Advisor : Dr. Hsu Presenter : Chih-Ling Wang Author : Fabio A. Gonzalez, Juan Carlos Galeano ACM GECCO 2005

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 2 Outline  Motivation  Objection  Proper noun  NS-SOM model structure.  Experimentation  Introduction  Background work  Conclusion  My opinion

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 3 Motivation  The anomaly detection problem could be seen as a classification problem. ─ First, in many real world problems, only normal samples are available at the training phase. ─ Second, the set of possible anomalies could be potentially infinite.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 4 Objective  This paper presents a model that can detect anomalies, even when trained only with normal samples, and can learn from encounters with new anomalies.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 5 Proper noun  Negative Selection Algorithm ─ The Negative Selection (NS) algorithm is based on the principles of self/no- self discrimination in the immune system. ─ It uses as input a set of strings that represents the normal data(self set) in order to generate detectors in the non-self space. The negative detectors are chosen by matching them to the self strings: if a detector matches a self string, it is discarded, otherwise, it is kept.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 6 NS-SOM model structure

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 7 Experimentation  Iris  Wisconsin Breast Cancer normal Unknown abnormal known abnormal Primary response Secondary response Confusion matrices for the secondary response Primary response and secondary response Confusion matrices of the primary and secondary response

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 8 Background work  Self/non-self discrimination and immune learning ─ Artificial immunes systems (AIS) which model the self/non-self discrimination function of the natural immune system (NIS) are mainly based on the NS algorithm, nevertheless, new models have been proposed, which are based on danger theory. ─ Both categories of AIS models, self/non-self discrimination based and immune learning based, have been extensively and independently investigated since the beginning of AIS research; however, there is not much work on combining these two approaches in one model.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 9 Background work (cont.)  Anomaly visualization ─ Usually, the anomaly detection problem arises in context where the monitored system is very complex in structure and function. ─ Information visualization techniques could help to deal with this complexity, since human perception could detect unexpected features in visual displays and recall related images to detect anomalies. ─ Most of the work done in anomaly visualization has been restricted to the area of computer security.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 10 Conclusion  The model combines a negative selection algorithm and a self- organizing map (SOM) in an immune inspired architecture.  One remarkable characteristic of the model is its ability to generate a 2-dimensional visual representation of the feature space.  This representation facilitates the understanding of the structure of the self/non-self space by producing a visual discrimination of the normal, known abnormal and unknown abnormal regions.  This feature could be useful for building interactive visualization tools.

Intelligent Database Systems Lab N.Y.U.S.T. I. M. 11 My opinion  Advantage:Combine AIS mode and immune learning based.  Disadvantage:Lack the mathematic formula.  Apply:Anomaly detection.