Survey of DCA for Abnormal Detection
Lei Ding
School of Information Science and Engineering, Jishou University, Jishou 416000, China
E-mail: yylxdinglei@126.com
Fei Yu
1
, Zhenghua Yang
2
1
Jiangsu Provincial Key Laboratory for Computer Information Processing Technology,
Soochow University, Soochow 215006, P. R. China
2
School of Information Science and Engineering, Jishou University, Jishou 416000, China
Email: hunanyufei@126.com
Abstract—As a latest immune algorithm, dendritic cell
algorithm (DCA) has been successfully applied into the
abnormal detection. First, this paper reviewed the research
progress of DCA from the following aspects: signal
extraction technology, DCA signal processing technology,
the decision method for load anomaly judgment, and the
application research of DCA. Next, the corresponding
solving thoughts for the main problems existing in the DCA
were proposed in this paper. Finally, the future research
trends of DCA were presented in this paper.
Index Terms—Immune algorithm; DCA; abnormal
detection; developing process of DCA
I. INTRODUCTION
Intrusion detection system (IDS) means a system that
can detect the intrusion by analyzing the data related to
the system safety. Generally speaking, IDS consists of
three parts, signal extraction module, analysis and process
module for DCA signal, and the decision module.
According to the detection method, IDS can be
categorized into two main approaches: misuse detection
and anomaly detection [1].
Misuse detection system detects the intrusion events
using pattern matching algorithm based on feature
matching. The feature set consists of the features
extracted from the known intrusion. The detection results
will be determined according to the matching degree
between the current sampled data and the features. If the
matching degree is greater than a given threshold, then
IDS can detect the intrusion attacks and give a warning.
The misuse detection has high measuring accuracy.
However, the misuse detection can’t find the unknown
attacks. Anomaly detection also known as the behavior-
based detection system detects the intrusion events
according to the behavior characteristics. The anomaly
detection compares the network behavior with the normal
behavior. If the current behavior deviates from normal
behavior, then IDS can detect the intrusion attacks. The
normal behavior patterns are constructed through some
statistics related to the system behavior. The abnormal
detection can detect unknown attack. However, it is hard
to get the statistics and give the preset anomaly threshold.
In addition to this, the anomaly detection has a high false
alarm rate.
All kinds of artificial cases based on the mechanisms
of immune system or the theory of immunology are
collectively called the artificial immune system (AIS). At
present the artificial immune system has been
successfully applied into a number of fields, such as the
intrusion detection, optimization, and classification, etc.,
and a series of artificial immune algorithm has been
presented since 1990s. The traditional immune system
consists of three basic algorithms: negative selection
algorithm (NSA) [2], clone selection algorithm (CSA) [3],
and immune network algorithm (INA) [4].
With the development of immunology, a new theory
called danger theory was presented in 1994 [5]. This
danger theory doesn’t rely on self-nonself discrimination
mechanism, and only reacts to the danger signal which
will do harm to health. The danger theory can deal with
some problem which can’t be resolved by the traditional
immune algorithm. For example, the bowels have
millions of bacteria, but the immune system doesn’t reject
these bacteria. The scientists can’t explain this
phenomenon with the traditional immune theory.
However, this phenomenon can be interpreted with the
danger theory, namely the immune system only reacts to
the danger signal which will do harm to health. In 2003,
Aickelin et al. first introduced the danger theory into the
artificial immune system [6]. In this paper, the danger
theory was translated into the realms of computer security,
namely creating AIS which doesn’t rely on self-nonself
discrimination. In 2005, Greensmith presented dendritic
cell algorithm (DCA) based on danger theory, and
applied it to the abnormal detection [7].
Dendritic cells are the presently known most powerful
professional antigen presenting cells (APC). DCA
imitates the process of the dendritic cells, namely
discriminating health tissue and infected tissue. The input
signal will be abstracted from the input antigen signal,
and the output signal will be acquired through the signal
processing module. Then, IDS can estimate the dangerous
level of the antigens, and can determine whether the
intrusion behavior occurs or not [8]. In 2006, Greensmith
et al. substantiated the claims that DCA has the ability to
detect the intrusion behavior [9]. In this paper, a port scan
detection is performed.
Compared with the traditional artificial immune
algorithm, DCA is the latest artificial immune algorithm,
JOURNAL OF SOFTWARE, VOL. 8, NO. 8, AUGUST 2013
doi:10.4304/jsw.8.8.2087-2094