Integrating real-time analysis with the dendritic cell algorithm through segmentation

ABSTRACT

As an immune inspired algorithm, the Dendritic Cell Algorithm (DCA) has been applied to a range of problems, particularly in the area of intrusion detection. Ideally, the intrusion detection should be performed in real-time, in order to continuously detect misuses, as soon as they occur. Consequently, the analysis process performed by an intrusion detection system must operate in real-time or near-to real-time. The analysis process of the DCA is currently performed offline, therefore to improve the algorithm's performance we suggest the development of a real-time analysis component. The initial step of the development is to apply segmentation to the DCA. This involves segmenting the current output of the DCA into slices and performing the analysis in various ways. Two segmentation approaches are introduced and tested in this paper, namely antigen based segmentation (ABS) and time based segmentation (TBS). The results of the corresponding experiments suggest that applying segmentation produces different and significantly better results in some cases, when compared to the standard DCA without segmentation. Therefore, we conclude that the segmentation is applicable to the DCA for the purpose of real-time analysis.

REFERENCES

• 1: Y. Al-Hammadi, U. Aickelin, and J. Greensmith. DCA for Bot Detection. In Proceedings of the IEEE World Congress on Computational Intel ligence (WCCI), pages 1807--1816, 2008.
• 2: Rajeev Alur , David L. Dill, A theory of timed automata, Theoretical Computer Science, v.126 n.2, p.183-235, April 25, 1994 [doi>10.1016/0304-3975(94)90010-8]
• 3: Michael J. Crawley. Statistics: An Introduction Using R. Wiley Blackwell, 2005.
• 4: Leandro R. de Castro , Jonathan Timmis, Artificial Immune Systems: A New Computational Intelligence Paradigm, Springer-Verlag New York, Inc., Secaucus, NJ, 2002
• 5: Henning Dierks, PLC-automata: a new class of implementable real-time automata, Theoretical Computer Science, v.253 n.1, p.61-93, Feb. 17, 2001 [doi>10.1016/S0304-3975(00)00089-X]
• 6: D. Fox, W. Burgard, and S. Thrun. The dynamic window approach to collision avoidance. Robotics&Automation Magazine, IEEE, 4(1), 1997.
• 7: J. Greensmith. The Dendritic Cel l Algorithm. PhD thesis, School of Computer Science, University of Nottingham, 2007.
• 8: Julie Greensmith , Uwe Aickelin, Dendritic cells for SYN scan detection, Proceedings of the 9th annual conference on Genetic and evolutionary computation, July 07-11, 2007, London, England [doi>10.1145/1276958.1276966]
• 9: Julie Greensmith , Uwe Aickelin, The Deterministic Dendritic Cell Algorithm, Proceedings of the 7th international conference on Artificial Immune Systems, August 10-13, 2008, Phuket, Tailand [doi>10.1007/978-3-540-85072-4_26]
• 10: J. Greensmith, J. Feyereisl, and U. Aickelin. The DCA: SOMe Comparison A comparative study between two biologically-inspired algorithms. Evolutionary Intelligence, 1(2):85--112, 2008.
• 11: Feng Gu , Julie Greensmith , Uwe Aickelin, Further Exploration of the Dendritic Cell Algorithm: Antigen Multiplier and Time Windows, Proceedings of the 7th international conference on Artificial Immune Systems, August 10-13, 2008, Phuket, Tailand [doi>10.1007/978-3-540-85072-4_13]
• 12: Christopher Kruegel , Fredrik Valeur , Giovanni Vigna , Richard Kemmerer, Stateful Intrusion Detection for High-Speed Networks, Proceedings of the 2002 IEEE Symposium on Security and Privacy, p.285, May 12-15, 2002
• 13: M. B. Lutz and G. Schuler. Immature, semi-mature and fully mature dendritic cells: which signals induce tolerance or immunity? TRENDS in Immunology, 23(9):445--449, 2002.
• 14: R. Oates, J. Greensmith, U. Aickelin, J. Garibaldi, and G. Kendall. The Application of a Dendritic Cell Algorithm to a Robotic Classifier. In Proceedings of the 6th International Conference on Artificial Immune (ICARIS), pages 204--215, 2007.
• 15: R. Oates, G. Kendall, and J. Garibaldi. Frequency Analysis for Dendritic Cell Population Tuning: Decimating the Dendritic Cell. Evolutionary Intelligence, 1(2), 2008.
• 16: T. Stibor, J. Timmis, and E. Claudia. A Comparative Study of Real-Valued Negative Selection to Statistical Anomaly Detection Techniques. In the 4th International Conference on Artificial Immune Systems (ICARIS), pages 262--375, 2005.
• 17: Z. H. Zhang and H. Shen. Application of online-training SVMs for real-time intrusion detection with dierent considersations. Computer Communications, 28(12):1428--1442, 2005.
• 18: Chaochen Zhou , Michael R. Hansen, Duration Calculus: A Formal Approach to Real-Time Systems (Monographs in Theoretical Computer Science. an Eatcs Seris), SpringerVerlag, 2004

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.m Miscellaneous

General Terms:
Algorithms, Experimentation, Performance

Keywords:
dendritic cell algorithm, intrusion detection systems, real-time analysis, segementation