Source-linked AI summary
The Deterministic Dendritic Cell Algorithm
Julie Greensmith, Uwe Aickelin
TL;DR
The paper tackles the difficulty of analysing the stochastic DCA and develops a deterministic, controllable version tested on port-scan data. It reduces parameters and random elements, examines cell-number and time-window effects, and introduces Kα, which is reported as more sensitive than MCAV to output fluctuations.
Problem
The original DCA performs well on large real-time datasets but is difficult to analyse because of its many random-based elements and parameters.
Method
The paper proposes, implements, and tests a deterministic DCA with reproducible antigen handling and a new magnitude-sensitive metric, Kα.
Results
Kα is more sensitive than MCAV to minor fluctuations in cell output and provides a more precise overview of classifications for the tested antigen types.
Takeaways & Limitations
The dDCA provides a comparable and controllable form of the DCA for studying its internal relationships and parameter effects.
Takeaways & Limitations
The dDCA can suffer severe misclassifications when signal data are advanced relative to antigen, so performance may be impaired with delayed antigen.
Abstract
from arXiv · showhide
The Dendritic Cell Algorithm is an immune-inspired algorithm orig- inally based on the function of natural dendritic cells. The original instantiation of the algorithm is a highly stochastic algorithm. While the performance of the algorithm is good when applied to large real-time datasets, it is difficult to anal- yse due to the number of random-based elements. In this paper a deterministic version of the algorithm is proposed, implemented and tested using a port scan dataset to provide a controllable system. This version consists of a controllable amount of parameters, which are experimented with in this paper. In addition the effects are examined of the use of time windows and variation on the number of cells, both which are shown to influence the algorithm. Finally a novel metric for the assessment of the algorithms output is introduced and proves to be a more sensitive metric than the metric used with the original Dendritic Cell Algorithm.
1 Introduction
The paper addresses the difficulty of analysing the stochastic Dendritic Cell Algorithm by proposing a controllable deterministic version for examining its internal relationships and function.
- The Dendritic Cell Algorithm is a second-generation Artificial Immune System based on models of human dendritic cells.It emerged from interdisciplinary efforts to develop biologically grounded algorithms for application domains.
- The original DCA has low CPU requirements and needs no extensive training, supporting its use in real-time computer security.
- More than 10 parameters and stochastic elements made the original DCA difficult to analyse and left parameter selection somewhat arbitrary.Examples include random cell selection and variable thresholds.
- The paper proposes, implements, and tests a deterministic DCA to uncover the algorithm’s internal relationships and function.The deterministic formulation is intended to support computational analyses of parameter relationships.
2 DCA Overview
The DCA models dendritic-cell activity as a population-based detection process and has been applied mainly to computer-security tasks, including port-scan and botnet detection.
- The DCA abstracts dendritic-cell biology into a population-based algorithm for detection and correlation.Different cells process signals over different time periods and generate individual outputs.
- DCA research has focused primarily on security applications, especially computer-security problems.
- The algorithm has been applied to port-scan detection and classified 13 million antigens in under 100 seconds in comparison with a self-organizing map.
- The DCA has also been applied to botnet detection and produced high true-positive rates with low rates of false positives.
- Robotic-security work used a controlled object-discrimination experiment and later frequency-tuning analysis that highlighted filter properties and lifespan-limit importance.
- Two optimizations used in this paper are real-valued individual-cell outputs and tissue-centric signal processing.
3 The Deterministic DCA (dDCA)
The dDCA replaces stochastic, parameter-heavy processing with a smaller deterministic design, explicit assumptions, and reproducible antigen handling. It uses MCAV and the magnitude-sensitive Kα metric to classify antigen types, with thresholds derived from signal data.
- Assumptions: A uniform lifespan distribution, identical signal exposure, and at least two signal categories are assumed to make the system repeatable and controllable.The required categories are an activating danger signal and an inhibitory safe signal.
- Antigen handling: The antigen profile replaces random sampling and overwriting with an array recording antigen values and collection counts for exact reproducibility.This also removes dynamic-memory overhead and concerns about antigen flooding.
- Deterministic design: The deterministic version reduces the original DCA’s more than 10 parameters to three, including cell number and signal-processing weights.The number of cells is set to 100 initially but varied experimentally.
- Deterministic design: The dDCA simplifies signal processing from three output signals and three signal categories to two of each, using safe and danger inputs.The resulting procedure computes interim costimulation and context outputs.
- Metrics: MCAV measures the proportion of antigen of each type presented by fully mature cells, with antigen types defined as sets of identical antigen values.
- Metrics: MCAV does not capture the magnitude of mean context values because -1 and -200 are treated identically in its calculation.
- Metrics: Kα uses the magnitudes of mean context values to produce real-valued anomaly scores, and TK classifies values above the threshold as anomalous.TK is defined from weighted input-signal sums and mean iterations per cell incarnation.
4 Experimental Analysis
The experiments validate the deterministic DCA against the original, then examine cell-count variation, execution time, and time-window effects using a real outbound port-scan dataset. They compare MCAV with the magnitude-sensitive Kα metric across these conditions.
- Experimental Setup: The experiments use approximately 25,000 antigens and 38 signal sets from a monitored remote shell session containing one danger and one safe signal.The danger signal is outbound network-packet rate; the safe signal is its inverse rate of change.
- Experimental Setup: The dDCA is tested with 100 artificial cells and a maximum lifespan limit of 100 csm signal units unless otherwise specified.Lifespan increments are derived from the maximum limit divided by the number of cells.
- Validation: Compared with the original DCA, the dDCA shows the same MCAV trends but less polarization between normal and anomalous processes.The comparison uses one dDCA run against three original-DCA runs, with results presented in Table 1.
- E1: Cell Number Experiments: Cell-number experiments vary n = {1, 5, 10, 50, 100, 500, 1000, 5000} while recording MCAV, Kα, cell behavior statistics, and execution time.The experiments expect the greatest variation between 1 and 100 cells.
- E1: Cell Number Experiments: Beyond a certain cell count, output values remain similar because system capacity exceeds input requirements, while execution time appears linear in cell number.The time-window experiments shift signals by up to 20 seconds before and after their original positions and evaluate MCAV and Kα.
5 Experimental Analysis
The experiments show that cell population size and signal timing affect dDCA outputs, while Kα can provide more precise information than MCAV for borderline or fluctuating processes. The dDCA also appears tolerant of delayed signals but performs poorly when signals precede antigens.
- E1: Cell Numbers: Increasing the number of cells affects performance, with MCAV increases for pts and bash and smaller changes for sshd and nmap.For pts and bash, the increase is more pronounced; Kα shows similar but less noticeable trends for these processes.
- E1: Cell Numbers: Kα provides improved information for borderline processes such as pts and bash, whose roles in facilitating the nmap scan complicate anomaly assessment.The passage identifies these processes as difficult to classify as anomalous or normal.
- E1: Cell Numbers: As cell numbers increase, output values converge, possibly because the lifespan limit or threshold range does not scale with population size.A second explanation is that the system eventually exceeds the input data’s requirements, so additional cells produce similar values.
- E2: Time Windows: Kα represents process classifications more precisely than MCAV in the timed experiments, including marked differences for nmap and pts between time offsets -20 and zero.The authors therefore use Kα for subsequent empirical and theoretical DCA assessment.
- E2: Time Windows: Minor fluctuations in pts output remain near 0 under Kα but are amplified by MCAV’s binary cell classification.This indicates greater sensitivity of Kα to small output fluctuations.
- E2: Time Windows: A signal delay of 2-4 seconds improves results, while correct classification persists for almost 10 seconds and suggests tolerance to at least a five-second lag.The 2-4 second delay corresponds to the average number of cell iterations per lifespan.
- E2: Time Windows: Advancing signals ahead of antigens causes incorrect classification between time offsets -20 and 0 for both MCAV and Kα.The proposed explanation is that cells incorporate only signals received after their generation, not preceding information.
6 Conclusions
The deterministic DCA provides a controllable, replayable alternative whose outputs follow similar trends to the original, while revealing parameter, timing, and metric effects. Its applicability remains constrained by timing conditions and requires broader testing.
- The dDCA produces similar trends to the original DCA while enabling exact experiment replay, predictable output, and fewer parameters.These properties make the system simpler to implement and its results more reliable and consistent.
- Kα is more sensitive than MCAV to minor output fluctuations and provides a more precise overview of antigen classification.
- 500 cells is the apparent saturation point for both MCAV and Kα on this port scan dataset.Increasing the cell count makes process discrimination less obvious, although the cause remains unclear.
- Within a tolerance range, the dDCA can handle delayed input signals, but advanced signal data can cause severe misclassifications.The authors suggest avoiding applications where delayed antigen may impair performance.
- Further work will examine the algorithm’s internal relationships across real-world and synthetic data and compare it with standard techniques.This work aims to select parameters appropriately across applications.