Evolutionary Intelligence

, Volume 1, Issue 2, pp 85–112 | Cite as

The DCA: SOMe comparison

A comparative study between two biologically inspired algorithms
  • Julie Greensmith
  • Jan Feyereisl
  • Uwe Aickelin
Research Paper


The dendritic cell algorithm (DCA) is an immune-inspired algorithm, developed for the purpose of anomaly detection. The algorithm performs multi-sensor data fusion and correlation which results in a ‘context aware’ detection system. Previous applications of the DCA have included the detection of potentially malicious port scanning activity, where it has produced high rates of true positives and low rates of false positives. In this work we aim to compare the performance of the DCA and of a self-organizing map (SOM) when applied to the detection of SYN port scans, through experimental analysis. A SOM is an ideal candidate for comparison as it shares similarities with the DCA in terms of the data fusion method employed. It is shown that the results of the two systems are comparable, and both produce false positives for the same processes. This shows that the DCA can produce anomaly detection results to the same standard as an established technique.


Dendritic cell algorithm Self-organizing map SYN scan detection Comparison 


  1. 1.
    Aickelin U, Bentley P, Cayzer S, Kim J, McLeod J (2003) Danger theory: the link between AIS and IDS. In: Proceedings of the 2nd international conference on artificial immune systems (ICARIS), LNCS 2787, pp 147–155. Springer, HeidelbergGoogle Scholar
  2. 2.
    Albayrak S, Scheel C, Milosevic D, Muller A (2005) Combining self-organizing map algorithms for robust and scalable intrusion detection. In: International conference on computational intelligence for modelling, control and automation and international conference on intelligent agents, Web technologies and Internet commerce, vol 2Google Scholar
  3. 3.
    Amini M, Jalili R, Shahriari HR (2006) RT-UNNID: A practical solution to real-time network-based intrusion detection using unsupervised neural networks. Comput Secur 25(6):459–468CrossRefGoogle Scholar
  4. 4.
    Bailey-Lee C, Roedel C, Silenok E (2003) Detection and characterization of port scan attacks. Technical report, University of California San Diego (UCSD)Google Scholar
  5. 5.
    Balthrop J, Esponda F, Forrest S, Glickman M (2002) Coverage and generaliszation in an artificial immune system. In: Proceedings of the genetic and evolutionary computation conference (GECCO), pp 3–10Google Scholar
  6. 6.
    Bejtlich R (2005) Extrusion detection: security monitoring for internal intrusions. Addison-Wesley, ReadingGoogle Scholar
  7. 7.
    Bentley P, Greensmith J, Ujjin S (2005) Two ways to grow tissue for artificial immune systems. In: Proceedings of the 4th international conference on artificial immune systems (ICARIS), LNCS 3627. Springer, Heidelberg, pp 139–152Google Scholar
  8. 8.
    Bivens A, Palagiri C, Smith R, Szymanski B, Embrechts M (2002) Network-based intrusion detection using neural networks. Intell Eng Syst Artif Neural Netw 12(1):579–584Google Scholar
  9. 9.
    Bolzoni D, Etalle S, Hartel P, Zambon E (2006) Poseidon: a 2-tier anomaly-based network intrusion detection system. In: Fourth IEEE international workshop on information assurance (IWIA’06), vol 0, pp 144–156. IEEE Computer Society, Los AlamitosGoogle Scholar
  10. 10.
    Sung-Bae Cho (2002) Incorporating soft computing techniques into a probabilitistic intrusion detection system. IEEE Trans Syst Man Cybern 32(2):154–160CrossRefGoogle Scholar
  11. 11.
    Choy J, Cho SB (2001) Anomaly detection of computer usage using artificial intelligence techniques. Adv Artif Intell PRICAI 2000 2112:31–43CrossRefGoogle Scholar
  12. 12.
    Coico R, Sunshine G, Benjamini E (2003) Immunology: a short course. Wiley-Liss, New YorkGoogle Scholar
  13. 13.
    Cross S, Harrison R, Kennedy R (1995) Introduction to neural networks. Lancet 346(8982):1075–1079CrossRefGoogle Scholar
  14. 14.
    de Castro L, Timmis J (2002) Artificial immune systems: a new computational approach. Springer, LondonzbMATHGoogle Scholar
  15. 15.
    DeLooze L (2006) Attack characterization and intrusion detection using an ensemble of self-organizing maps. In: International joint conference on neural networks (IJCNN’06), pp 2121–2128Google Scholar
  16. 16.
    Depren O, Topallar M, Anarim E, Ciliz MK (2005) An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Exp Syst Appl 29(4):713–722CrossRefGoogle Scholar
  17. 17.
    Dostoevsky F nmap., last accessed, 5/10/07
  18. 18.
    Forrest S, Perelson A, Allen L, Cherukuri R (1994) Self-nonself discrimination in a computer. In: Proceedings of the IEEE symposium on security and privacy. IEEE Computer Society, pp 202–209Google Scholar
  19. 19.
    Fox KL, Henning RR, Reed JH, Simonian R (1990) A neural network approach towards intrusion detection. In: Proceedings of the 13th national computer security conference, vol 10Google Scholar
  20. 20.
    Gollmann D (1999) Computer security. Wiley, Inc., New YorkGoogle Scholar
  21. 21.
    Gonzalez F, Dasgupta D (2002) Neuro-immune and self-organizing map approaches to anomaly detection: a comparison. In: Proceedings of the 1st international conference on artificial immune systems, pp 203–211Google Scholar
  22. 22.
    Gonzalez F, Dasgupta D (2003) Anomaly detection using real-valued negative selection. J Genet Program Evol Machines 4:383–403CrossRefGoogle Scholar
  23. 23.
    González FA, Galeano JC, Rojas DA, Veloza-Suan A (2005) Discriminating and visualizing anomalies using negative selection and self-organizing maps. In: Proceedings of the 2005 conference on genetic and evolutionary computation. ACM Press, New York, pp 297–304Google Scholar
  24. 24.
    Greensmith J (2007) The Dendritic cell algorithm. PhD Thesis, School of Computer Science, University Of NottinghamGoogle Scholar
  25. 25.
    Greensmith J, Aickelin U (2007) Dendritic cells for syn scan detection. In: Proceedings of the genetic and evolutionary computation conference (GECCO 2007), pp 49–56Google Scholar
  26. 26.
    Greensmith J, Aickelin U, Cayzer S (2005) Introducing dendritic Cells as a novel immune-inspired algorithm for anomaly detection. In: Proceedings of the 4th international conference on artificial immune systems (ICARIS), LNCS 3627. Springer, Heidelberg, pp 153–167Google Scholar
  27. 27.
    Greensmith J, Aickelin U, Tedesco G (2008) Information fusion for anomaly detection with the dca. Information Fusion, tbc(tbc):tbc, 2008Google Scholar
  28. 28.
    Greensmith J, Aickelin U, Twycross J (2006) Articulation and clarification of the dendritic cell algorithm. In: Proceedings of the 5th International Conference on Artificial Immune Systems (ICARIS), LNCS 4163, pp 404–417Google Scholar
  29. 29.
    Greensmith J, Twycross J, Aickelin U (2006) Dendritic cells for anomaly detection. In: Proceedings of the congress on evolutionary computation (CEC), pp 664–671Google Scholar
  30. 30.
    Gunes Kayacik H, Nur Zincir-Heywood A, Heywood MI (2007) A hierarchical SOM-based intrusion detection system. Eng Appl Artif Intell 20(4):439–451CrossRefGoogle Scholar
  31. 31.
    Higgins JJ (2004) An introduction to modern nonparametric statistics. Thomson, Brooks/Cole, Pacfic GroveGoogle Scholar
  32. 32.
    Hofmeyr S, Forrest S (1998) Intrusion detection using sequences of system calls. J Comput Secur 6:151–180Google Scholar
  33. 33.
    Hofmeyr S, Forrest S (1999) Immunity by design. In: Proceedings of the genetic and evolutionary computation conference (GECCO), pp 1289–1296Google Scholar
  34. 34.
    Höglund A, Hätönen K (1998) Computer network user behaviour visualization using self organizing maps. In: Niklasson L, Bodén M, Ziemke T (eds) Proceedings of ICANN98, the 8th international conference on artificial neural networks, vol 2. Springer, London, pp 899–904Google Scholar
  35. 35.
    Höglund A, Hätönen K, Sorvari A (2000) A computer host-based user anomaly detection system using the self-organizing map. In: IJCNN (5), pp 411–416Google Scholar
  36. 36.
    Horeis T (2003) Intrusion detection with neural networks–combination of self-organizing maps and radial basis function networks for human expert integration. Student Research Grants Technical report, IEEE Computational Intelligence SocietyGoogle Scholar
  37. 37.
    Ji Z, Dasgupta D (2004) Real-valued negative selection algorithm with variable-sized detectors. In: Proceedings of the genetic and evolutionary computation conference (GECCO), pp 287–298Google Scholar
  38. 38.
    Jirapummin C, Wattanapongsakorn N, Kanthamanon P (2002) Hybrid neural networks for intrusion detection system. In: 2002 international technical conference on circuits/systems, computers and communications (ITC-CSCC 2002), Phuket, Thailand, pp 928–931Google Scholar
  39. 39.
    Jung J, Paxson V, Berger A, Balakrishnan H (2004) Fast portscan detection using sequential hypothesis testing. In: Proceedings 2004 IEEE symposium, Security and privacy, pp 211–225Google Scholar
  40. 40.
    Kandel ER, Schwartz JH, Jessell TM (2000) Principles of neural science. McGraw-Hill/Appleton & Lange, New YorkGoogle Scholar
  41. 41.
    Kayacik H, Zincir-Heywood A, Heywood M (2003) On the capability of an SOM based intrusion detection system. In: Proceedings of the international joint conference on neural networks, vol 3Google Scholar
  42. 42.
    Kayacik HG, Zincir-Heywood N (2005) Analysis of three intrusion detection system benchmark datasets using machine learning algorithms. In: Proceedings of IEEE international conference on intelligence and security informatics (ISI 2005), vol 3495 of LNCS. Springer, Atlanta, pp 362–367Google Scholar
  43. 43.
    Khanna R, Liu H (2006) System approach to intrusion detection using HMM. In: International conference on communications and mobile computing, pp 349–354Google Scholar
  44. 44.
    Kim J, Bentley P (2001) Evaluating negative selection in an artificial immune system for network intrusion detection. In: Proceedings of the genetic and evolutionary computation conference (GECCO), pp 1330–1337Google Scholar
  45. 45.
    Kim J, Bentley P, Aickelin U, Greensmith J, Tedesco G, Twycross J (2007) Immune system approaches to intrusion detection —a review. Natural computing, page tbc, 2007 (to appear, accepted for publication)Google Scholar
  46. 46.
    Kohonen T (1981) Automatic formation of topological maps of patterns in a self-organizing system. In: Proceedings of the 2nd scandinavian conference on image analysis, pp 214–220Google Scholar
  47. 47.
    Kohonen T (1996) Self-organizing maps. Springer, BerlinGoogle Scholar
  48. 48.
    Kohonen T (1990) The self-organizing map. Proc IEEE 78(9):1464–1480CrossRefGoogle Scholar
  49. 49.
    Lee SC, Heinbuch DV (2001) Training a neural-network based intrusion detector to recognizenovel attacks. Syst Man Cybern Part A IEEE Trans 31(4):294–299CrossRefGoogle Scholar
  50. 50.
    Lei JZ, Ghorbani A (2004) Network intrusion detection using an improved competitive learning neural network. In: 2nd annual conference on communication networks and services research, pp 190–197Google Scholar
  51. 51.
    Lichodzijewski P, Nur Zincir-Heywood A, Heywood M (2002) Dynamic intrusion detection using self organizing maps. In: The 14th annual canadian information technology security symposium (CITSS)Google Scholar
  52. 52.
    Lutz M, Schuler G (2002) Immature, semi-mature and fully mature dendritic cells: which signals induce tolerance or immunity? Trends Immunol 23(9):991–1045CrossRefGoogle Scholar
  53. 53.
    Matzinger P (1994) Tolerance, danger and the extended family. Annu Rev Immunol 12:991–1045Google Scholar
  54. 54.
    Matzinger P (2007) Friendly and dangerous signals: is the tissue in control? Nat Immunol 8(1):11–13CrossRefGoogle Scholar
  55. 55.
    Miller P, Inoue A (2003) Collaborative intrusion detection system. In: 22nd international conference of the north American fuzzy information processing society (NAFIPS 2003), pp 519–524Google Scholar
  56. 56.
    Murphy K, Travers P, Walport M (2008) Janeway’s Immunobiology. Garland science, 7th ednGoogle Scholar
  57. 57.
    Oates R, Greensmith J, Aickelin U, Garibaldi J, Kendall G (2007) The application of a dendritic cell algorithm to a robotic classifier. In: Proceedings of the 6th international conference on artificial immune systems (ICARIS), LNCS 4628, pp 204–215Google Scholar
  58. 58.
    Oates R, Kendall G, Garibaldi J (2007) Frequency analysis for dendritic cell population tuning: decimating the dendritic cell. Evol Intell (submitted)Google Scholar
  59. 59.
    Ramadas M, Ostermann S, Tjaden B (2003) Detecting anomalous network traffic with self-organizing maps. In: Proceedings of recent advances in intrusion detection: 6th international symposium (RAID 2003). Springer, PittsburghGoogle Scholar
  60. 60.
    Rhodes BC, Mahaffey JA, Cannady JD (2000) Multiple self-organizing maps for intrusion detection. In: Proceedings of the 23rd national information systems security conferenceGoogle Scholar
  61. 61.
    Ritter H, Martinetz T, Schulten K (1992) Neural computation and self-organizing maps: an introduction. Addison-Wesley Longman Publishing Co., Inc., BostonzbMATHGoogle Scholar
  62. 62.
    Roesch M (1999) Snort—lightweight intrusion detection for networks. In: Proceedings of the 13th USENIX conference on system administration (LISA), USENIX Association, pp 229–238Google Scholar
  63. 63.
    Sarasamma S, Zhu Q (2006) Min–max hyperellipsoidal clustering for anomaly detection in network security. Syst Man Cybern Part B IEEE Trans 36(4):887–901CrossRefGoogle Scholar
  64. 64.
    Sarasamma ST, Zhu QA, Huff J (2005) Hierarchical Kohonenen net for anomaly detection in network security. IEEE Trans Syst Man Cybern Part B Cybern 35(2):302–312CrossRefGoogle Scholar
  65. 65.
    Garner S (1995) Weka: the waikato environment for knowledge analysis. In: Proceedings of the New Zealand computer science research students conference, pp 57–64Google Scholar
  66. 66.
    Somayaji A, Locasto M, Feyereisl J (2007) Panel on the future of biologically-inspired security: is there anything left to learn? In: New security paradigms workshop (NSPW’07)Google Scholar
  67. 67.
    Sporri R, Caetano C (2005) Inflammatory mediators are insufficient for full dendritic cell activation and promote expansion of cd4+ t cell populations lacking helper function. Nat Immunol 6(2):163–170CrossRefGoogle Scholar
  68. 68.
    Staniford S, Hoagland J, McAlerney J (2002) Practical automated detection of stealthy portscans. J Comput Secur 10(1–2):105–136Google Scholar
  69. 69.
    Stibor T, Mohr P, Timmis J, Eckert C (2005) Is negative selection appropriate for anomaly detection? In: Proceedings of genetic and evolutionary computation conference (GECCO), pp 321–328Google Scholar
  70. 70.
    Stibor T, Eckert C, Timmis J (2006) Artificial immune systems for IT-security. Inf Technol 48(3):168–173Google Scholar
  71. 71.
    Stibor T, Timmis J, Eckert C (2006) On permutation masks in hamming negative selection. In: Proceedings of the 5th international conference on artificial immune systems (ICARIS), LNCS 4163, pp 122–135Google Scholar
  72. 72.
    Timmis J (2007) Artificial immune systems: today and tomorrow. Nat Comput 6(1):1–18zbMATHCrossRefMathSciNetGoogle Scholar
  73. 73.
    Twycross J (2007) Integrated innate and adaptive artificial immune systems applied to process anomaly detection. PhD Thesis, University Of NottinghamGoogle Scholar
  74. 74.
    Twycross J, Aickelin U (2005) Towards a conceptual framework for innate immunity. In: Proceedings of the 4th international conference on artificial immune systems (ICARIS), LNCS 3627. Springer, Heidelberg, pp 112–125Google Scholar
  75. 75.
    Twycross J, Aickelin U (2006) Libtissue—implementing innate immunity. In: Proc of the congress on evolutionary computation (CEC), pp 499–506Google Scholar
  76. 76.
    Wang W, Guan X, Zhang X, Yang L (2006) Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data. Comput Secur 25(7):539–550CrossRefGoogle Scholar
  77. 77.
    Williams C, Harry R, McLeod J (2007) Mechanisms of apoptosis induced DC suppression. J Immunol (submitted)Google Scholar
  78. 78.
    Yoo IS (2004) Visualizing windows executable viruses using self-organizing maps. In: Proceedings of the 2004 ACM workshop on visualization and data mining for computer security. ACM Press, New York, pp 82–89Google Scholar

Copyright information

© Springer-Verlag 2008

Authors and Affiliations

  1. 1.School of Computer ScienceUniversity of NottinghamNottinghamUK

Personalised recommendations