The dendritic cell algorithm

Artificial immune systems are a collection of algorithms inspired by the hu-man immune system. Over the past 15 years, extensive research has been per-formed regarding the application of artificial immune systems to computer secu-rity. However, existing immune-inspired techniques have not performed as wellas expected when applied to the detection of intruders in computer systems. Inthis thesis the development of the Dendritic Cell Algorithm is described. This isa novel immune-inspired algorithm based on the function of the dendritic cells ofthe human immune system. In nature, dendritic cells function as natural anomalydetection agents, instructing the immune system to respond if stress or damageis detected. Dendritic cells are a crucial cell in the detection and combination of‘signals’ which provide the immune system with a sense of context. The Den-dritic Cell Algorithm is based on an abstract model of dendritic cell behaviour,with the abstraction process performed in close collaboration with immunolo-gists. This algorithm consists of components based on the key properties ofdendritic cell behaviour, which involves data fusion and correlation components.In this algorithm, four categories of input signal are used.The resultant algorithm is formally described in this thesis and is validatedon a standard machine learning dataset. The validation process shows that theDendritic Cell Algorithm can be applied to static datasets and suggests that thealgorithm is suitable for the analysis of time-dependent data. Further analysisand evaluation of the Dendritic Cell Algorithm is performed. This is assessedthrough the algorithm’s application to the detection of anomalous port scans.The results of this investigation show that the Dendritic Cell Algorithm can beapplied to detection problems in real-time. This analysis also shows that de-tection with this algorithm produces high rates of false positives and high ratesof true positives, in addition to being robust against modification to system pa-rameters. The limitations of the Dendritic Cell Algorithm are also evaluated andpresented, including loss of sensitivity and the generation of false positives undercertain circumstances. It is shown that the Dendritic Cell Algorithm can performwell as an anomaly detection algorithm and can be applied to real-world, real-time data.