Efficient Algorithms for String-Based Negative Selection

  • Michael Elberfeld
  • Johannes Textor
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5666)


String-based negative selection is an immune-inspired classification scheme: Given a self-set S of strings, generate a set D of detectors that do not match any element of S. Then, use these detectors to partition a monitor set M into self and non-self elements. Implementations of this scheme are often impractical because they need exponential time in the size of S to construct D. Here, we consider r-chunk and r-contiguous detectors, two common implementations that suffer from this problem, and show that compressed representations of D are constructible in polynomial time for any given S and r. Since these representations can themselves be used to classify the elements in M, the worst-case running time of r-chunk and r-contiguous detector based negative selection is reduced from exponential to polynomial.


Negative Selection Anomaly Detection Exponential Time Pattern Path Negative Selection Algorithm 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Forrest, S., Perelson, A.S., Allen, L., Cherukuri, R.: Self-nonself discrimination in a computer. In: Proceedings of the IEEE Symposium on Research in Security and Privacy, pp. 202–212 (1994)Google Scholar
  2. 2.
    Forrest, S., Hofmeyr, S.A., Somayaji, A.: Computer immunology. Communications of the ACM 40, 88–96 (1997)CrossRefGoogle Scholar
  3. 3.
    Stibor, T.: Foundations of r-contiguous matching in negative selection for anomaly detection. Natural Computing (2008)Google Scholar
  4. 4.
    Stibor, T.: On the Appropriateness of Negative Selection for Anomaly Detection and Network Intrusion Detection. Ph.D thesis, Darmstadt University of Technology (2006)Google Scholar
  5. 5.
    D’Haeseleer, P.: An immunological approach to change detection: theoretical results. In: Proceedings of the 9th IEEE Computer Security Foundations Workshop, pp. 18–26 (1996)Google Scholar
  6. 6.
    Timmis, J., Hone, A., Stibor, T., Clark, E.: Theoretical advances in artificial immune systems. Theoretical Computer Science 403, 11–32 (2008)MathSciNetCrossRefzbMATHGoogle Scholar
  7. 7.
    Esponda, C.: Negative Representations of Information. Ph.D thesis, University of New Mexico (2005)Google Scholar
  8. 8.
    Ukkonen, E.: On-line construction of suffix-trees. Algorithmica 14(3), 249–260 (1995)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Stibor, T.: Phase transition and the computational complexity of generating r-contiguous detectors. In: de Castro, L.N., Von Zuben, F.J., Knidel, H. (eds.) ICARIS 2007. LNCS, vol. 4628, pp. 142–155. Springer, Heidelberg (2007)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Michael Elberfeld
    • 1
  • Johannes Textor
    • 1
  1. 1.Institut für Theoretische InformatikUniversität zu LübeckLübeckGermany

Personalised recommendations