# Towards Bio-Inspired Anomaly Detection Using the Cursory Dendritic Cell Algorithm
## 6 Discussion  
Firstly, the CDCA modular approach proved helpful for experimentation and development, allowing the effortless replacement of modules. Compared with related work focusing on the formal specification of the algorithm using Haskell (Functional Programming), an object-oriented approach enables problem abstraction into classes, and data can be easily stored in objects. This approach provides an easy way to add new data and functions. Additionally, by using Python as the coding language, we have the most recent data science and machine learning packages available, which can be very useful to extend the algorithm to a hybrid or ensemble approach, or replace specific algorithm components' functionality with statistical and machine learning techniques. However,  
Figure 11: Illustration of the testbed used for the generation of the _M2M using OPC UA_ dataset. Figure obtained from [28]. an object-oriented approach does not easily describe the algorithm's processes and data flow, since it focuses on their implementation. Additionally, the object-oriented approach can be used as a formal specification of the algorithm since there is no definition of actual mathematical functions. Secondly, using a clustering approach compared to PCA or RST may present advantages regarding the problem modeling limitation. We know that the bulk of the effort in the pre-processing stage is in deciding how to calculate the input signals (_danger_ and _safe_). With clustering, the main advantage is creating a normal baseline, which is used to derive the input signals when new unseen data are processed. The creation of data clusters achieves this baseline. Since PCA and RST focus on an automatic feature selection process, no expert knowledge is required. However, they cannot decide how to map input data to _safe_ and _danger_ signals and, consequently, define the normal baseline. Another advantage of clustering in the pre-processing stage is the possibility of continuous adaptation of the normal baseline. However, the K-Means technique used in this work does not contemplate this functionality. Thirdly, considering the online application of the algorithm, CDCA presents a strategy of enabling the classification of _antigens_ as soon as the _DC_ migrates. This strategy is similar to previous work regarding segmentation, but with the difference of not defining a fixed segmentation window (based on time or number of _antigens_). Dynamic segmentation is achieved, which can deal with online dynamics during real-time analysis. However, the proposed approach does not provide real-time analysis since the classification has time delays. Additionally, compared with the iDCA, the proposed approach is not ready to be applied in a streaming problem, since an _antigen_ classification requires processing a mini-batch of _antigens_ instead of classifying data points as soon as they become available. Fourthly, based on the achieved results after testing the CDCA in industrial context scenarios (based on datasets) and comparing the performance with existing classifiers, the proposed approach is competitive with other anomaly detection approaches. In the _SKAB_ dataset, CDCA outperforms state-of-the-art approaches, such as deep neural networks and regression approaches. This performance is mainly assessed by the \(F_{1}\) score, false alarm, and missed alarm rates. The algorithm seems to be very good in identifying anomalies, given its consistently low MAR values. However, on the other hand, it also consistently misclassified normal occurrences surrounding the anomalous region as anomalous, as indicated by its high FAR value. Furthermore, the CDCA is tested in terms of parameter variation, where the role of _DC_ population and sample sizes is residual, i.e., the variables do not significantly influence the algorithm's performance. However, there is a slight impact on performance (indicated by lower MAR values at the cost of higher FAR values), with higher sample sizes and a slight increase in performance (lower FAR) with an increasing population size.