Exploration Of The Dendritic Cell Algorithm Using The Duration Calculus

Feng Gu, Julie Greensmith and Uwe Aickelin

School of Computer Science, University of Nottingham Nottingham, NG8 1BB, UK {fxg,jqg,uxa}@cs.nott.ac.uk

Abstract. As one of the newest members in Artificial Immune Systems
(AIS), the Dendritic Cell Algorithm (DCA) has been applied to a range of problems. These applications mainly belong to the field of anomaly detection. However, real-time detection, a new challenge to anomaly de- tection, requires improvement on the real-time capability of the DCA. To assess such capability, formal methods in the research of real-time systems can be employed. The findings of the assessment can provide guideline for the future development of the algorithm. Therefore, in this paper we use an interval logic based method, named the Duration Calcu- lus (DC), to specify a simplified single-cell model of the DCA. Based on the DC specifications with further induction, we find that each individ-
ual cell in the DCA can perform its function as a detector in real-time. Since the DCA can be seen as many such cells operating in parallel, it is potentially capable of performing real-time detection. However, the analysis process of the standard DCA constricts its real-time capability. As a result, we conclude that the analysis process of the standard DCA should be replaced by a real-time analysis component, which can perform
periodic analysis for the purpose of real-time detection.

1 Introduction

Artificial Immune Systems (AIS) [3] are computer systems inspired by both theoretical immunology and observed immune functions, principles and models, which can be applied to real world problems. As the natural immune system is evolved to protect the body from a wealth of invading micro-organisms, artificial immune systems are developed to provide the same defensive properties within a computing context. One of these immune inspired algorithms called the Den- dritic Cell Algorithm (DCA) [6] is based on the function of the dendritic cells of the innate immune system. An abstract model of the behaviour of natural dendritic cells is used as the foundation of the developed algorithm. Currently, the DCA has been applied to numerous problems, including port scan detection [6], Botnet detection [1] and a classifier for robotic security [12]. They refer to the field of anomaly detection, which involves discriminating between normal and anomalous data, based on the knowledge of the normal data. The success of the applications has suggested that the DCA shows not only good perfor- mance on detection rate, but also the ability to reduce the rate of false alarms in

comparison to other systems including Self Organising Maps [7]. However, one problem with DCA has been pointed out in [9], that is, the analysis process of the algorithm is performed offline rather than online in real-time. This results in the delays between when potential anomalies initially appear and when they are correctly identified. Such delays can be problematic for applications with strict time constraints, as they are often speed-critical. To solve this problem, it is desired to improve the real-time capability of the DCA, in order to develop an effective real-time detection system. A real-time system [14] is a reactive system which, for certain inputs, has to compute the corresponding outputs within given time bounds (real-time cri- teria). The design of real-time systems generally requires high precision due to their particular application areas. The high precision is achieved by using for- mal methods that are based on the mathematical models of the systems being designed. The formal methods make it possible to specify the system properties at different levels and abstractions, as well as formally verify the specifications before implementing. One of the formal methods for specifying real-time sys- tems is known as the Duration Calculus (DC) [17], which is a temporal logic and calculus for describing and reasoning about the properties of a real-time system over time intervals. The DC can specify the safety properties, bounded responses and duration properties of a real-time system, which can be logically verified through proper induction. Unlike predicate calculus [5] using time points to express time-depedent state variables or observables of the specified system, the DC uses time intervals with the focus on the implicit semantics level rather than the explicit syntactic level. As a result, it is more convenient and concise to use the DC to specify patterns or behaviour sequences of a real-time system over time intervals, compared to

…(Full text truncated)…