The DCA:SOMe Comparison A comparative study between two biologically-inspired algorithms

2 3 4 5 6 7 Julie Greensmith · Jan Feyereisl · Uwe Aickelin 8 9 The DCA: SOMe Comparison 10 11 A comparative study between two biologically-inspired algorithms 12 13 14 15 16 17 Received: date / Accepted: date 18 19 20 Abstract The Dendritic Cell Algorithm (DCA) is an immune-inspired algorithm, developed for the 21 purpose of anomaly detection. The algorithm performs multi-sensor data fusion and correlation which 22 results in a ‘context aware’ detection system. Previous applications of the DCA have included the 23 detection of potentially malicious port scanning activity, where it has produced high rates of true 24 positives and low rates of false positives. In this work we aim to compare the performance of the 25 DCA and of a Self-Organizing Map (SOM) when applied to the detection of SYN port scans, through 26 experimental analysis. A SOM is an ideal candidate for comparison as it shares similarities with the 27 DCA in terms of the data fusion method employed. It is shown that the results of the two systems are 28 comparable, and both produce false positives for the same processes. This shows that the DCA can 29 produce anomaly detection results to the same standard as an established technique. 30 31