# DeepDCA: Novel Network-Based Detection of IoT Attacks Using Artificial Immune System
## 6 DeepDCA: Deep Learning Dendritic Cell Algorithm
### Anomaly Metrics: \(Mcav\) and \(K_{\alpha}\)  
Once all data are processed it is possible to calculate the metric \(MCAV\), the mature context antigen value obtained from the output of the cell that comes out from the run-time process. The value is calculated for each antigen of type \(\alpha\), where the symbol \(\alpha\) is associated with a collection of antigens that has in common the same value. Clearly we could think by its name that \(MCAV\) is indeed a measure of the proportion of antigen contained in a completely mature cell whose value is given by the following equation:  
\[MCAV_{\alpha}=\frac{M}{Ag}, \tag{10}\]  
where \(MCAV_{\alpha}\) represents the antigen \(MCAV\) of the collection \(\alpha\), M is the number of the mature antigen of type \(\alpha\), and \(Ag\) is the total quantity of antigen presented for the collection of an antigen of type \(\alpha\). This is a probabilistic metric with values between zero and one, when the value of this metric goes to one, the probability of maturity of the cell increase. The classification rule applied on as follows in Equation (11) and the deterministic DCA could be described by mean of the Algorithm 2. \[f(x)=\left\{ \begin{array}{cl}\text{Malicious,}&\text{if }MCAV>at\\ \text{Legitimate,}&\text{otherwise}\end{array} \right. \tag{11}\]```
1:set number of cells;
2:initialise DCs()
3:while data do
4:for input do
5:if Antigens then
6: antigenCounterC++;
7: cell index = antigen counter modulus cells number;
8: DC of cell index assigned antigen;
9: update DCs antigen profile;
10:else\(\triangleright\) This occur for the case of signals;
11: calculate csm and k;
12:for all DCs do
13: DC.lifspan- = csm;
14: DC.k+ = k;
15:if DC.lifespan less or equal to then
16: logDC.k, number of antigens and iterations
17: reset DC();
18:endif
19:endfor
20:endif
21:endfor
22:endwhile
23:for antigen Type do
24: calculate anomaly metrics;
25:endfor
```

**Algorithm 2** Deterministic DCA for Intrusion Detection. ## 7 Experimental Setup

To conduct this experiment, we performed it on the High-Performance Computing (HPC) called Aziz. Aziz is a Fujitsu PRIMERGY CX400, Intel True Scale QDR, Intel Xeon E5-2695v2 12C 2.4 GHz which provides a distributed computing facility. Moreover, for data exploration and visualization we used ggplot framework [72] and Seaborn [73]. For preprocessing steps and feature engineering, Pandas framework [74] and Numpy framework [75] have been used. To calculate performance metrics, scikit-learn [76] was used, and finally, for data analysis, scikit-learn framework and Keras [77] were used. We followed the Cross-Industry Standard Process (CRISP) methodology [78]. CRISP is a structured methodology for Data Mining projects conceived in 1996. which contain the following steps: Business Understanding, Data Understanding, Data Preparation, Modeling, Evaluation, and Deployment. ### Data Acquisition

To illustrate the effectiveness of our model we selected The BoT-IoT dataset [79]. This data was created in the Cyber Range Lab of The center of UNSW Canberra Cyber and has more than 72,000,000 records which include DDoS, DoS, OS and Service Scan, Keylogging and Data exfiltration attacks. Table 3 illustrate the statistics distribution of considered features. ### Exploratory Data Analysis (Understanding the Data)

Exploratory Data Analysis (EDA) is \"the process of examining a dataset without preconeceived assumptions about the data and its behavior\" [80]. The goal of the EDA is to evaluate the cleanliness and missing data and explorer the relationships among variables which give us a deep insight (see Table 4). ### Preparation Steps of Bot-IoT Dataset

Handling Categorical Variables

The categorical feature values ('saddr','sport', 'daddr', 'dport','state', 'category', and'subcategory') have converted into numeric values for easily applying feature selection method and the DeepDCA algorithm.