Application of Biomimetic Algorithms in Cybersecurity for Anomaly Detection

This thesis focuses on the design and evaluation of a biomimetic approach for anomaly detection in network traffic. The theoretical part first introduces the context of cybersecurity and the importance of anomaly detection, followed by an explanation of the principles of biomimetic algorithms, their classification, and a detailed overview of selected methods. Based on a literature review and defined criteria, the negative selection algorithm inspired by the mechanisms of the immune system was chosen for the practical part. Input features for the model were selected using LightGBM. The algorithm was first implemented in a basic version using only the selected attributes. Subsequently, this approach was extended with domain-specific rules that enable dynamic adjustment of detection sensitivity. The results show that the hybrid approach achieves the highest detection performance. A permutation analysis confirmed the importance of transmission features and volume-based characteristics in model decision-making. Additionally, the effectiveness of individual rules was evaluated, highlighting the importance of their formulation. The proposed solution was validated on a real dataset and demonstrated potential for deployment in environments with limited availability of labeled data. The thesis includes Python code that allows for replication and further development of the proposed method.