The Dendritic Cell Algorithm for Intrusion Detection

Abstract

As one of the solutions to intrusion detection problems, Artificial Immune Systems (AIS) have shown their advantages. Unlike genetic algorithms, there is no one archetypal AIS, instead there are four major paradigms. Among them, the Dendritic Cell Algorithm (DCA) has produced promising results in various applications. The aim of this chapter is to demonstrate the potential for the DCA as a suitable candidate for intrusion detection problems. We review some of the commonly used AIS paradigms for intrusion detection problems and demonstrate the advantages of one particular algorithm, the DCA. In order to clearly describe the algorithm, the background to its development and a formal definition are given. In addition, improvements to the original DCA are presented and their implications are discussed, including previous work done on an online analysis component with segmentation and ongoing work on automated data preprocessing. Based on preliminary results, both improvements appear to be promising for online anomaly-based intrusion detection. IntroductionArtificial Immune Systems (AIS) (de Castro and Timmis, 2003) are computer systems inspired by both theoretical immunology and observed immune functions, principles and models, which are applied to real world problems. The human immune system, from which AIS draw inspiration, is evolved to protect the host from a wealth of invading microorganisms. AIS are developed to provide the similar defensive properties within a computing context. Initially AIS were based on simple models of the human immune system. As noted by Stibor et al. (2005), "first generation algorithms", including negative selection and clonal selection do not produce the same high quality performance as the human immune system. These algorithms, negative selection in particular, are prone to problems with scaling and the generation of excessive false alarms when used to solve problems such as network based intrusion detection. Recent AIS use more rigourous and up-to-date immunology and are developed in collaboration with modellers and immunologists. The resulting algorithms are believed to encapsulate the desirable properties of immune systems including robustness, error tolerance, and self-organisation (de Castro and Timmis, 2003).One such "second generation" AIS is the Dendritic Cell Algorithm (DCA) , inspired by the function of the dendritic cells (DCs) of the innate immune system. It incorporates the principles of a key novel theory in immunology, termed the "danger theory" (Matzinger, 2002). This theory suggests that DCs are responsible for the initial detection of invading microorganisms, in addition to the induction of various immune responses against such invaders. An abstract model of natural DC behaviour is used as the foundation of the developed algorithm. The DCA has been successfully applied to numerous computer security related, more specific, 2 intrusion detection problems, including port scan detection , botnet detection (Al-Hammadi et al., 2008) and a classifier for robot secur...

Android malware detection using the dendritic cell algorithm

“…In this section, the data preprocessing, the signal selections, the antigen multiplier, and the DCA in [6][7][8] are introduced. The original DCA was modified slightly to classify our collected data.…”

“…This removed the need for expert domain knowledge for signal selection. In 2010, Gu et al formalized the algorithm by using set theory and basic functions [8].…”

“…DCA is an artificial immune system (AIS), which was inspired by the danger theory for the human immune system (HIS) [3]. Although DCA has shown promising results in detecting anomalies [3][4][5][6][7][8], selecting the signals for DCA can be a difficult task. Gu et al [7] showed that PCA could assist DCA in signal selections.…”

Enabling Cyber Physical Systems with Wireless Sensor Networking Technologies, Multiagent System Paradigm, and Natural Ecosystems

“…For example, an agent ASSN may exchange data about some events of interest (e.g., spreading wildfire) with other agents ASSN and then recommend better sampling rates to some of its agents AAoI based on processing priorities and available resources. The agent ASSN may also recommend specific data acquisition algorithms (e.g., Dendritic Cell Algorithm like in [30]) depending on particular ongoing circumstances such as sensors' connectivity and spatial events.…”

An Improved Dendritic Cells Algorithm for Detecting P2P Bots

“…Inspired from the abstract model of natural DCs behaviors, a new artificial immune system based the functions of DCs, called the Dendritic Cell Algorithm (DCA) [9], was proposed by incorporating the principles of immunology with the "danger theory" [16]. The DCA has been successfully applied to many fields, particularly in computer security related, intrusion detection, port scan, botnet detection [15], and a classifier for robotic security [13,17], data analysis and plants recognition [18], and so on.…”