Memodelkan Artificial Immune System dengan Negative Selection Algorithm untuk Deteksi Anomali pada Jaringan Web Server

Abstract

Serangan siber pada web server terus berkembang dengan pola baru yang sulit dideteksi oleh signature-based IDS konvensional. Penelitian ini memodelkan Artificial Immune System (AIS) menggunakan Negative Selection Algorithm (NSA) sebagai anomaly-based IDS untuk mendeteksi anomali pada jaringan web server dengan meniru proses seleksi negatif sel-T pada sistem imun manusia. Dataset NSL-KDD diolah melalui service filtering (HTTP, SMTP, FTP, SSH, DNS, dan private), one-hot encoding, min-max normalization, serta feature selection berbasis menghasilkan 11 fitur terpilih dari 62 fitur. Model dibangun menggunakan 61.039 data normal dari KDDTrain+ dan diuji menggunakan KDDTest-21 melalui 3.000 skenario kombinasi parameter jumlah detektor, radius maksimal self-sample, dan radius detektor. Model terbaik diperoleh dengan 300 detektor, R = 1,6, dan rd = 0,25, menghasilkan F1-score 78,24%, detection rate 82,50%, false positive rate 20,26%, dan akurasi 80,89%.

Cyberattacks on web servers continue to evolve with new patterns that are difficult to detect using conventional signature-based IDS. This study models an Artificial Immune System (AIS) using Negative Selection Algorithm (NSA) as an anomaly-based IDS to detect anomalies in web server networks, mimicking the negative selection process of T-cells in the human immune system. The NSL-KDD dataset was processed through service filtering (HTTP, SMTP, FTP, SSH, DNS, and private), one-hot encoding, min-max normalization, and mean decrease in impurity-based feature selection, resulting in 11 selected features out of 62. The model was trained using 61,039 normal instances from KDDTrain+ and tested on KDDTest-21 across 3,000 parameter combination scenarios involving the number of detectors, maximum self-sample radius, and detector radius. The best model was obtained with 300 detectors, R = 1.6, and rd = 0.25, achieving an F1-score of 78.24%, a detection rate of 82.50%, a false positive rate of 20.26%, and an accuracy of 80.89%.