# Towards Bio-Inspired Anomaly Detection Using the Cursory Dendritic Cell Algorithm
## 7 Conclusions  
A new immune-based algorithm for anomaly detection was developed, called CDCA, which expands the existing DCA by enabling the original algorithm to be applied in real time as an online anomaly detection tool. CDCA uses the same principles of the original DCA version but iteratively updates the classification metric and keeps track of said metric for individual data points. This leads to near real-time classification. This development was implemented on top of the algorithm's proposed modular approach, which allows the replacing of components, namely, how data are collected, how they are pre-processed, how values of abnormality are extracted, how these values are mapped to the algorithm's inherent population, and how the population behaves. Consequentially, this modular approach allows faster development and experimentation.  
Additionally, an adaptation of K-Means, an unsupervised clustering algorithm, was implemented to allow us to ease the implementation process of the DCA, namely by making it substantially easier to model any given real-valued problem. The hypothesis is that by using K-Means to extract abnormality values, both algorithms can help each other. DCA can be more flexible and adapt to different problem contexts, while K-Means' classification is more robust for detecting collective anomalies, which are closely located in time. In the end, it is possible to define a normal baseline behavior of the system, which is highly desired in anomaly detection applications.  
CDCA was validated on two different datasets representative of industrial IoT scenarios, namely _SKAB_ and _M2M using OPC UA_. The results revealed some solid advantages and a few shortcomings in the implemented algorithm. As an advantage, the usage of signals from K-Means effectively increases the algorithm's performance by leveraging anomalies as phenomena that tend to happen with the proximity in time, corroborating the hypothesis that the algorithms benefit each other. The current implementation also outperforms a significant amount of existing techniques found in the _SKAB_ scoreboard and is competitive with the iDCA implementation in the _M2M using OPC UA_ dataset. However, shortcomings of the algorithm are also identified. First, it suffers from a high rate of false positives. Secondly, there is a classification delay inherent to the voting mechanism of the _DC_ population. Finally, single-point anomalies are harder to detect as the algorithm leverages time locality, which is suitable for collective anomalies.  
The main drawback of the algorithm is its delay in classification, which needs to be further refined to offer immediate classification. The association with other scalable techniques for generating signals, other than K-Means, is also a good point to explore. Moreover, the algorithm was not built with time optimization in mind and, thus, optimizing the algorithm for performance is also a promising avenue for future work. Furthermore, the application of CDCA in a real industrial test case is critical before being validated as a real-time implementation. Finally, validation of the CDCA in a much larger set of datasets outside the industrial scope is needed. This way, we will assess the feasibility of using the approach in different application contexts and its sensibility when generalizing to different anomaly detection domains.  
The contributions to this work are the following: Conceptualization, C.P. and R.P.; methodology, C.P.; software, C.P.; validation, C.P. and R.P.; formal analysis, C.P.; investigation, C.P.; resources, R.P. and G.G.; data curation, C.P.; writing--original draft preparation, C.P. and R.P.; writing--review and editing, R.P. and C.P.; visualization, C.P.; supervision, R.P. and G.G.; project administration, R.P. and G.G.; funding acquisition, G.G. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.