# Towards Bio-Inspired Anomaly Detection Using the Cursory Dendritic Cell Algorithm
## 5 Validation and Results
### M2M Using OPC UA Dataset  
The _M2M using OPC UA_ dataset [45] was developed by simulating known network attacks, and was designed to assess intrusion detection solutions in industrial scenarios [28].  
\begin{table}
\begin{tabular}{c c c c} \hline
**Algorithm** & **F1** & **FAR [\%]** & **MAR [\%]** \\ \hline Perfect detector & 1 & 0 & 0 \\ \hline Conv-AE & **0.79** & 13.69 & 17.77 \\ \hline MSET & 0.73 & 20.82 & 20.08 \\ \hline
**CDCA\_100\_10\_20** & 0.72 & 37.95 & 5.71 \\ \hline
**CDCA\_100\_5\_20** & 0.72 & 38.27 & 5.75 \\ \hline
**CDCA\_50\_10\_20** & 0.72 & 38.33 & 5.80 \\ \hline
**CDCA\_20\_10\_20** & 0.72 & 37.74 & 6.41 \\ \hline
**CDCA\_100\_1\_20** & 0.72 & 38.76 & **5.57** \\ \hline
**CDCA\_100\_10\_5** & 0.72 & 29.18 & 15.24 \\ \hline
**CDCA\_100\_10\_20\_original** & 0.71 & 28.27 & 15.61 \\ \hline LSTM-AE & 0.68 & 14.24 & 35.56 \\ \hline T-squared+Q (PCA) & 0.67 & 13.95 & 36.32 \\ \hline MSCRED & 0.64 & 13.56 & 41.16 \\ \hline LSTM & 0.64 & 15.40 & 39.93 \\ \hline K-Means w/ _danger_ signals & 0.61 & 25.63 & 35.76 \\ \hline LSTM-VAE & 0.56 & 9.13 & 55.03 \\ \hline T-squared & 0.56 & 12.14 & 52.56 \\ \hline Autoencoder & 0.45 & 7.56 & 66.57 \\ \hline Isolation forest & 0.40 & **6.86** & 72.09 \\ \hline Null detector & 0 & 0 & 100 \\ \hline \end{tabular}
\end{table}
Table 1: Results for all existing algorithms in _SKAB_ and the Cursory Dendritic Cell Algorithm (DCDA) with different parameter’s range, as well as the adapted version of K-Means. Results for CDCA and K-Means are an average of the results of 10 repeated test instances.  
\begin{table}
\begin{tabular}{c c c c c} \hline  & \multicolumn{2}{c}{**Classification Cycle Delay**} & \multicolumn{2}{c}{**Classification Delay [ms]**} \\ \hline
**Test Instance** & **Mean** & \
\begin{tabular}{c} **Standard** \\ **Deviation** \\ \end{tabular} & **Mean** &
\begin{tabular}{c} **Standard** \\ **Deviation** \\ \end{tabular} \\ \hline CDCA\_100\_1\_20 & 7.684 & 10.290 & 1.537 & 2.097 \\ \hline CDCA\_20\_10\_20 & 7.758 & 8.797 & 2.124 & 3.242 \\ \hline CDCA\_100\_10\_20 & 7.818 & 8.654 & 2.112 & 2.288 \\ \hline CDCA\_100\_10\_5 & 10.081 & 10.889 & 2.662 & 2.854 \\ \hline CDCA\_100\_10\_20\_original & 14.055 & 15.185 & 3.801 & 4.450 \\ \hline \end{tabular}
\end{table}
Table 2: Performance results for CDCA with multiple parameters. These results pertain only to outliers and are an average of the results of 10 repeated test instances.  
The dataset was obtained from a lab CPPS testbed (see Figure 11), where multiple nodes implement the OPC UA protocol for communication.  
All traffic is recorded and saved, and significant features, such as message size and source and destination addresses are extracted to form the dataset. Different attacks, such as Denial of Service (DoS), Message Spoofing, and Man-in-the-middle (MITM), are injected in the same time series and spaced with normal system operation moments. The dataset contains a single continuous time series of 107,633 records, each with 29 network-related features. The real-valued features were standardized such that K-Means hyperspheres have the same significance in each dimension. Additionally, because our implementation is not compatible with categorical data, all categorical data was ignored, as well as real-valued data and integers that do not have meaningful information from Euclidean distance (e.g., destination or source ports).