# Towards Bio-Inspired Anomaly Detection Using the Cursory Dendritic Cell Algorithm
## 2 Artificial Immune Systems
### Danger-Inspired Algorithms
#### 2.4.2 Algorithm Overview  
Danger theory algorithms are inspired by the notion of cells emitting signals that characterize their state (normal or in distress), which shows that the immune system is activated by the pathogen's destructive effects on tissue rather than by explicitly recognizing the pathogen. Considering the DCA [24], four signals can be defined, such as _safe_, _danger_, _PAMP_, and _inflammatory cytokines_. There are other algorithms, such as the Toll-like receptor (TLR) algorithm [25], which specifies what _PAMP_ is and focuses on the definition of a _T cell_ matching measure during the _DC_ presenting stage. [PERSON]'s thesis [26] suggested DCA, inspired by the danger theory, for anomaly detection applied to intrusion detection. This technique is directly inspired by _DCs_, which are cells that gather data indiscriminately (_antigens_), and it is the most important danger-inspired algorithm currently. Algorithm 4 represents the DCA algorithm. When using DCA, there is no training phase. Instead, input signals, such as _danger_, _safe_, _PAMP_, and inflammatory signals, must be retrieved from the dataset. Currently, the extraction of these signals is dependent on expert knowledge since there is no universal process suitable to every application scenario. Each signal describes the degree of hazard in the problem domain (as a non-negative real number or integer). So, input signals may be:  
* _PAMP_ signals indicate the presence of hazard with high certainty. Figure 5: Simplified model of the danger theory. Note that immature _dendritic cells_ (_iDCs_) collect a vast variety of _antigens_, not just one specific type, as illustrated for simplicity purposes. Initially, _iDCs_ navigate throughout the body, collecting encountered _antigens_ without discriminating between self or non-self. While navigating, _iDCs_ also collect signals emitted by dying tissue cells. Damaged cells release chaotically their contents, which are identified as _danger signals_ by neighboring _iDCs_. On the other hand, when cell death is programmed, _iDCs_ still collect _antigens_ while recognizing _safe signals_. After collecting a sufficient amount of signals, a _iDC_ evolves into either mature _dendritic cells mDC_ or semi-mature _dendritic cells smDC_, depending if the overall context during _antigens_ collection was dangerous or safe. In both cases, _DC_ migrate and present their collected _antigens_ to _T cells_. _T cells_ that recognize the _antigens_ presented by _mDCs_ proceed to initiate an immune response, or they can tolerate _antigens_ if presented by _smDCs_. With intermediate confidence, _safe_ signals imply the absence of danger. * _Danger_ signals indicate the presence of danger with a lower degree of certainty compared with _PAMP_. * _Inflammatory cytokines_ magnify all prior signals, amplifying their consequences. **Input:**_Ag_ input data (_antigens_)  
_N DC_ population size  
\(c\) number of times any _antigen_ will be presented to distinct _DCs_  
_tmigration_ migration threshold after which _DC_ matures  
_tmax MCAV_ threshold above which the _antigen_ is considered anomalous  
**Output:** Classification of _antigens_ as normal or anomalous  
**foreach**_ag in Ag_**do**  
\(signals=compute\_signals(ag)\)  
\(DC_{sample}=sample\_random(c)\)  
**foreach**_dc in \(DC_{sample}\)_**do**  
/* update csm and k of each cell and store the _antigen_ in  
/* their repertoire */  
\( expose(dc,ag,signals)\)  
**if**_dc.csm_\(>t_{migration}\)**then**  
if**_dc.k_\(>0\)**then**  
/* this will increment the count of _mDC_ for all _antigens_  
that this cell had  
\( mature(dc,MATURE)\)  
else  
\( mature(dc,SEMIMATURE)\)  
end  
**end**  
**foreach**_ag in Ag_**do**  
\(macv=\frac{mDC\_count(ag)}{c}\)  
**if**_macv_\(>t_{macv}\)**then**  
\(classify(ag,OUTLIER)\)  
else  
\(classify(ag,NORMAL)\)  
end  
**end**  
**Algorithm 4**Dendritic Cell Algorithm (DCA), adapted from [PERSON] [26]. As previously stated, the modeling of these signals is inextricably linked to the problem.