Detecting Danger: The Dendritic Cell Algorithm

Abstract

Summary. The Dendritic Cell Algorithm (DCA) is inspired by the function of the dendritic cells of the human immune system. In nature, dendritic cells are the intrusion detection agents of the human body, policing the tissue and organs for potential invaders in the form of pathogens. In this research, and abstract model of DC behaviour is developed and subsequently used to form an algorithm, the DCA. The abstraction process was facilitated through close collaboration with laboratorybased immunologists, who performed bespoke experiments, the results of which are used as an integral part of this algorithm. The DCA is a population based algorithm, with each agent in the system represented as an 'artificial DC'. Each DC has the ability to combine multiple data streams and can add context to data suspected as anomalous. In this chapter the abstraction process and details of the resultant algorithm are given. The algorithm is applied to numerous intrusion detection problems in computer security including the detection of port scans and botnets, where it has produced impressive results with relatively low rates of false positives.

Dendritic Cell Algorithm for Anomaly Detection in Unordered Data Set

“…When an antigen has been assessed by multiple DCs, the MCAV(mature context antigen value) will be calculated and compared with the anomaly threshold to determine whether the antigen is anomalous. More details please refer to [5,6].…”

Design and implementation of artificial immune system for detecting flooding attacks

“…Why do intestines contain millions of bacteria, yet the immune system does not react against these colonies of non-self invaders? [17]. The DCA algorithm is inspired from the behavior of dendritic cells whose primary role is as professional antigen presenting cell.…”

“…DCs exist in one of three states of differentiation at any one point in time, termed immature, semi-mature and mature [17]. The mechanism by which DCs process signals is complicated and the three signal concentrations are fused within the cell to influence the resulting output.…”

“…Conversely, if the environment contains mainly safe signals, then the context of the cell is 'normal' and all collected antigen are deemed as nonthreatening. The context is used to determine if an antigen is derived from a potential invader [17].…”

“…Whilst in the lymph nodes, DCs present antigen coupled with context signals, which is interpreted and translated into an immune response. In AISD system the focus is on the property of compartmentalization [17].…”