CN101604408A - A kind of generation of detecting device and detection method - Google Patents
A kind of generation of detecting device and detection method Download PDFInfo
- Publication number
- CN101604408A CN101604408A CN 200910029253 CN200910029253A CN101604408A CN 101604408 A CN101604408 A CN 101604408A CN 200910029253 CN200910029253 CN 200910029253 CN 200910029253 A CN200910029253 A CN 200910029253A CN 101604408 A CN101604408 A CN 101604408A
- Authority
- CN
- China
- Prior art keywords
- detecting device
- antigen
- string
- ripe
- generation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Abstract
The present invention relates to a kind of generation and detection method of detecting device, this method is an initial detector with maximum section definition; Then it is carried out the self-tolerance training.According to matched rule,, with dividing two sub-duration detectors of generation from this point between detector area, recursively each sub-range is detected simultaneously removing with the known point that is complementary from body in the detecting device.And in this process, carrying out the optimization of detecting device, the ripe detectors set that is generated is the most at last used with security of system and is protected.This invention has broken through the generation method and the matched rule of existing detecting device, has eliminated " leak " and redundancy detection device, and then has improved the formation efficiency and the detection efficiency of detecting device.
Description
Technical field
The present invention is that the various good characteristics with Immune System are applied in the computer system, be mainly used in practical problemss such as solving computer virus precaution, network invasion monitoring, the interleaving techniques field that belongs to bioinformatics and computer science is specifically related to a kind of generation and detection method of detecting device.
Background technology
Immune system protection body is avoided the invasion and attack of outside bacterium, virus etc., can discern external cell or molecule, eliminates these objectionable impuritiess then in body, observes paracytic appearance in the health simultaneously, and removes the cell that has made a variation.The matter of utmost importance that immunocyte faced is how to define from body/non-from body, and discerns.From body/non-identification from body is a kind of high efficiency mode identification problem.
At present, the research of artificial immune system comprises non-recognition mechanism and the theoretical two big classes of immunological network from body, wherein of paramount importance is 1994, the Negative Selection method (NSA) that is proposed when the generation of T cell and mechanism of action in the human simulation Immune System such as the professor Forrest of U.S. University of New Mexico, wherein the generation of detecting device is to negate one of committed step of system of selection.The various countries scientist has designed different detecting device generation methods at the different mode and the matched rules represented of antibody in the artificial immune system and antigen.
Whether change according to matching threshold r and detecting device length l, we can be divided into three major types with the generation method of detecting device in the Negative Selection method:
(1) the detecting device generation method that all do not change of r and l.
What people such as Forrest used is exhaustive detecting device generation method, and this method is a kind of method very consuming time, and its time complexity and space complexity are respectively
And O (lN
s), P wherein
mBe matching probability, P
fBe detecting device it fails to match probability, N
sFor from the body set sizes.We are the rise time and the big or small exponent function relation of gathering from body of detecting device as can be seen, and is easy to generate the redundancy detection device.In order to overcome these problems, people such as Patrik have proposed linear detector generation method and greedy detecting device generation method in 1996, the former institute's time-consuming is respectively with linear from body set sizes and detectors set size, but is exponential relationship with matching threshold r, and still has redundancy; The latter can eliminate redundancy, but the detecting device rise time is minimized.
(2) r is variable, the detecting device generation method that l is constant.
2004, people such as Zhang Heng proposed the variable detecting device generation method of a kind of r.This method has reduced " leak " quantity and has produced the iterations of ripe detecting device, makes the detecting device formation efficiency increase, but because pre-detector generates at random, the iterations that producing a ripe detecting device needs is
(P
DThe probability of representing any two string matchings, N
sFor from the body set sizes), its iterations be exponential growth from the body set sizes, needed time complexity is still very high; Work as r
cDuring＜l, still can't solve " leak " problem fully.
(3) l is variable, the detecting device generation method that r is constant.
People such as He Shen have proposed the variable detecting device generation method of a kind of detecting device length l in 2005, this method has been eliminated " leak " zone, make the detection efficiency of detecting device increase, but still there is a redundancy detection device problem, and the R fork tree that the generation of its detecting device is based on the L layer is searched coupling, and needed time complexity and space complexity are still very high.
In sum because original antigen, antibody all is to represent with the form of reluctant string of binary characters, so the present detecting device method of generationing all exist to some extent the detecting device formation efficiency lowly, leak and redundancy detection device problem.
Summary of the invention
Technical matters: the objective of the invention is thoroughly to eliminate " leak " zone and the redundancy detection problem that exist when generating detecting device in the prior art, thereby improve the operational efficiency and the non-ability of identification of detecting device, provide the high detecting device of a kind of formation efficiency and detection efficiency to generate and detection method from body.
The technical scheme that realizes the object of the invention is: a kind of detecting device generates and detection method, comprising:
Step 1: based on the generation of numerical value duration detector: comprise condition setting, promptly be provided with string of binary characters represent domain, from body, non-rule from body, antigen and antibody, be provided with and judge whether matched rule of detecting device and antigen, the interval of each ripe detecting device is set;
Step 2: detect protected data with detecting device;
It is characterized in that described matched rule is: for arbitrary string X=X
1X
2X
l, in the time of in and if only if its corresponding decimal system numerical value the drops on defined interval range, be coupling.
Condition setting specifically comprises in the above-mentioned steps 1:
1. domain setting: tangible by institute is X=X
1X
2X
iX
l(i=1,2 ..., l, X
i{ 0, length 1}) is that the string of binary characters of l constitutes to ∈.
2. from the body setting: the legal information in the artificial immune system is expressed as the form of string of binary characters usually.
Non-from the body setting: the invalid information in the artificial immune system, the common form that also is expressed as string of binary characters.
3. antigen setting: enter the information in the artificial immune system, comprise self-antigen and non-self-antigen.
Antibody is provided with: the ripe detecting device that artificial immune system produces through the self-tolerance inspection.
4. matched rule: for any string of binary characters X=X
1X
2X
l, in the time of in and if only if its corresponding decimal system numerical value drops on certain interval range that ripe detecting device has been set, claim character string and this maturation detecting device to mate.
According to top definition, from the angle of the one-dimensional space, produce based on the numerical value form based on duration detector generation method.
Be provided with between described ripe detector area and comprise the following steps:
Step 1: with length is antigen, the antibody that string of binary characters antigen, the antibody of l is converted into decimal system form, will again
With
Corresponding decimal value constitutes a closed interval (promptly being respectively interval upper and lower boundary), and this interval is initial detector;
Step 2: initial detector and known the set from body are carried out matching check, search in the detecting device with and remove, and will divide two sub-ranges of generation from this point between detector area, add the set of couple candidate detection device to from the point of body coupling;
Step 3: occur continuously from body in body set or when repeating from body, the sub-range that each division obtains is put in order, merged when known, promptly set is optimized to the couple candidate detection device;
Step 4: repeating step 2-3, up to detecting device no longer with known in body set till body mates, this moment, the detectors set of generation was ripe detectors set.
Described step 2 further comprises the following steps:
The string of binary characters form antigen that 1. step will need to detect is converted into decimal system numerical value;
Step is 2. according to matched rule, will carry out matching check between the antigen of decimal system form and ripe detector area; If mate, judge that promptly antigen is non-from body; Otherwise be from body.
The present invention is based on the duration detector generation method of numerical value form, utilize numerical value interval in the one-dimensional space as detecting device, the safeguard protection of participation system.Method of the present invention makes that not only the time complexity and the space complexity that generate detecting device are lower than the time complexity and the space complexity of existing detecting device generation method, and has thoroughly eliminated " leak " zone and redundancy detection device.
The present invention converts original reluctant string of binary characters to metric form, and promptly the detecting device represented of traditional binary character string forms just is transformed into the numerical value interval, has improved the formation efficiency and the detection efficiency of detecting device, has effectively improved relatively performance.
Beneficial effect:
(1) avoided determining to the r value
Matching threshold r is difficult to determine to have only best r value can obtain good recognition capability in minimized detection device number in existing three class methods.When the r value hour, will cause classification too thick, though the recognition capability of single detector is stronger, system effectiveness is higher; When if the r value is too small, can cause detecting device can't pass through self-tolerance, can not generate ripe detecting device, be easy to generate a large amount of leaks.When the r value was big, its classification was thinner, though effectively reduced the quantity of leak, needed to generate more detecting device and just can detect the non-from body of same quantity, and the cost that generates ripe detecting device is bigger; Especially when the r value was too big, feasible identification is non-sharply to be increased from the needed detector number of body, influence detection performance.So determining of r value is that traditional detecting device generation method is failed the problem of fine solution always.And the duration detector generation method based on the numerical value form that proposes in the invention has exactly been avoided determining the r value.
(2) eliminated " leak " zone
Existing generation method all can not satisfy the requirement that no leak accurately detects.The method that the present invention proposes is at the very start with binary string
With
The closed interval that corresponding decimal value constitutes is defined as initial detector, and length is that self-antigen and the non-self-antigen of l all drops in this interval range like this.So thoroughly eliminated " leak ".This is an important feature of this method.
(3) eliminated redundancy detection device problem
In the method matching process, in body set, occur continuously from body or when repeating when known from body, can be with the interval arrangement of the couple candidate detection device that has generated, merge, finally obtain mutually disjoint sub-range.And these sub-range detecting devices can identify all non-self-antigen that initial detector can be discerned.Therefore, the ripe detecting device after self-tolerance training and optimization need not carry out the elimination of redundancy detection device, has effectively improved the formation efficiency of detecting device.
Embodiment
Be described further below in conjunction with embodiment.
Known 32 scale-of-two from the body character string (suppose this string comprised all length be l from body):
00101000100100000100001010010011, the son that is divided into length and is l=4 is from body string assemble S,
S＝{0010，0101，1010，0100，1000，0001，0010，0100，1001，0010，0100，1000，0000，0000，0001，0010，0100，1000，0000，0001，0010，0101，1010，0100，1001，0010，0100，1001，0011}。
Represent that with using decimal number instead from the body substring in the S set corresponding son can be expressed as from the body string assemble:
S＝{2，5，10，4，8，1，2，4，9，2，4，8，0，0，1，2，4，8，0，1，2，5，10，4，9，2，4，9，3}
(1) generation of detecting device
Since Substring Length l=4, thus the initial detector interval range from 0000 to 1111 of binary mode, i.e. [0,15].The initial detector R that meets routine number field
1: [0,15].
According to the step 2 of top method, we are with initial detector R
1: in [0,15] with S set in first mate from body " 2 ", and remove the point " 2 " of coupling.From match point " 2 " interval is divided simultaneously, formed couple candidate detection device set R
2: [0,1] and [3,15].
With couple candidate detection device set R
2Mate from body " 5 " with in the S set second, drop in [3,15] interval through relatively finding it., simultaneously the interval is divided from here then with removing in interval [3,15] with from the point of body " 5 " coupling according to method, formed R
3: [0,1], [3,4], [6,15].
Again with R
3Mate and divide from body " 10 " with the next one in the S set.Form R
4: [0,1], [3,4], [6,9], [11,15].
Next with detecting device R
4What mate is from body " 4 ", because it is with continuous from body " 5 ", so the arrangement of couple candidate detection device can be merged generation R
5: [0,1], { 3}, [6,9], [11,15]; Repeat successively.
In this process, whenever duplicating from body or during continuously from body, all the couple candidate detection device set that produces is put in order, merged, do not increase with increase from the body number by the last number that we generate the couple candidate detection device as can be seen.
Finally, we obtain ripe detectors set is R:[6,7] and [11,15], binary mode is [0110,0111] and [1011,1111].
(2) detect the protected data string
Suppose that the protected data string is the character string R of length l=4
0: 0111,1000,0101,1001, corresponding decimal value is: 7,8,5,9.It is mated with the ripe detectors set R that generates,, find to have only 7 to mate, and 5,8,9 all can not mate with ripe detectors set with ripe detectors set according to matched rule.Thereby we can conclude: have only 7 for non-from body, and 5,8,9 be from body.Be to have only 0111 in the protected data string for non-, and 1000,0101,1001 be from body from body.
To sum up, we are as can be known based on the generation and the application thereof of the duration detector of numerical value form.
Claims (4)
1. a detecting device generates and detection method, comprising:
Step 1: the generation of numerical value duration detector, comprise condition setting, promptly be provided with string of binary characters and represent from body, non-rule from body, antigen and antibody, be provided with and judge whether matched rule of detecting device and antigen, the interval of each ripe detecting device is set;
Step 2: detect protected data with detecting device;
It is characterized in that described matched rule is: for arbitrary string X=X
1X
2X
l, in the time of in and if only if its corresponding decimal system numerical value the drops on defined interval range, be coupling.
2, method according to claim 1 is characterized in that, is provided with between described ripe detector area to comprise the following steps:
Step 1: with length is antigen, the antibody that string of binary characters antigen, the antibody of l is converted into decimal system form, will again
With
Corresponding decimal value constitutes a closed interval (promptly being respectively interval upper and lower boundary), and this interval is initial detector;
Step 2: with initial detector and knownly mate, removing in the detecting device with from the point of body coupling, and will be between detector area divide and generate two sub-ranges, add the set of couple candidate detection device to from this point from body set;
Step 3: occur continuously from body in body set or when repeating from body, the sub-range that each division obtains is put in order, merged when known, promptly set is optimized to the couple candidate detection device;
Step 4: repeating step 2-3, up to detecting device no longer with known in body set till body mates, this moment, the detectors set of generation was ripe detectors set.
3, method according to claim 1 is characterized in that, described step 2 further comprises the following steps:
The string of binary characters form antigen that 1. step will need to detect is converted into decimal system numerical value;
Step is 2. according to matched rule, will carry out matching check between the antigen of decimal system form and ripe detector area; If mate, judge that promptly antigen is non-from body; Otherwise be from body.
4, method according to claim 1 is characterized in that, condition setting also comprises in the above-mentioned steps 1:
1. domain setting: tangible by institute is X=X
1X
2X
iX
l(i=1,2 ..., l, X
i{ 0, length 1}) is that the string of binary characters of l constitutes to ∈;
2. from the body setting: the legal information in the artificial immune system is expressed as the form of string of binary characters usually;
Non-from the body setting: the invalid information in the artificial immune system, the common form that also is expressed as string of binary characters;
3. antigen setting: enter the information in the artificial immune system, comprise self-antigen and non-self-antigen;
Antibody is provided with: the ripe detecting device that the T cell in the artificial immune system produces through self-tolerance.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200910029253 CN101604408B (en) | 2009-04-03 | 2009-04-03 | Generation of detectors and detecting method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200910029253 CN101604408B (en) | 2009-04-03 | 2009-04-03 | Generation of detectors and detecting method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101604408A true CN101604408A (en) | 2009-12-16 |
| CN101604408B CN101604408B (en) | 2011-11-16 |
Family
ID=41470128
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 200910029253 Expired - Fee Related CN101604408B (en) | 2009-04-03 | 2009-04-03 | Generation of detectors and detecting method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101604408B (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101788891A (en) * | 2010-03-15 | 2010-07-28 | 江苏大学 | Quick and safe storage method based on disk and safe disk |
| CN103604591A (en) * | 2013-11-14 | 2014-02-26 | 沈阳工业大学 | Fault detection method of wheeled mobile robot |
| CN103957203A (en) * | 2014-04-19 | 2014-07-30 | 盐城工学院 | Network security defense system |
| CN106790101A (en) * | 2016-12-23 | 2017-05-31 | 北京邮电大学 | A kind of mature detector set creation method, intrusion detection method and device |
| CN107256350A (en) * | 2017-04-21 | 2017-10-17 | 武汉市工程科学技术研究院 | Cloud storage safety detection method based on artificial immunity |
| CN108337268A (en) * | 2018-03-16 | 2018-07-27 | 太原理工大学 | SQL injection attack detection based on Dynamic Clonal Selection Algorithm |
| CN110647585A (en) * | 2019-09-24 | 2020-01-03 | 江苏医健大数据保护与开发有限公司 | Data deployment system with automatic screening and backup functions |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2003058861A (en) * | 2001-08-15 | 2003-02-28 | Communication Research Laboratory | Method and device for detecting data error, software and storage medium therefor |
| JP3702464B2 (en) * | 2002-05-08 | 2005-10-05 | ソニー株式会社 | Data conversion device, data conversion method, learning device, learning method, program, and recording medium |
-
2009
- 2009-04-03 CN CN 200910029253 patent/CN101604408B/en not_active Expired - Fee Related
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101788891A (en) * | 2010-03-15 | 2010-07-28 | 江苏大学 | Quick and safe storage method based on disk and safe disk |
| CN103604591A (en) * | 2013-11-14 | 2014-02-26 | 沈阳工业大学 | Fault detection method of wheeled mobile robot |
| CN103604591B (en) * | 2013-11-14 | 2018-11-20 | 沈阳工业大学 | A kind of wheeled mobile robot fault detection method |
| CN103957203A (en) * | 2014-04-19 | 2014-07-30 | 盐城工学院 | Network security defense system |
| CN103957203B (en) * | 2014-04-19 | 2015-10-21 | 盐城工学院 | A kind of network security protection system |
| CN106790101A (en) * | 2016-12-23 | 2017-05-31 | 北京邮电大学 | A kind of mature detector set creation method, intrusion detection method and device |
| CN107256350A (en) * | 2017-04-21 | 2017-10-17 | 武汉市工程科学技术研究院 | Cloud storage safety detection method based on artificial immunity |
| CN108337268A (en) * | 2018-03-16 | 2018-07-27 | 太原理工大学 | SQL injection attack detection based on Dynamic Clonal Selection Algorithm |
| CN110647585A (en) * | 2019-09-24 | 2020-01-03 | 江苏医健大数据保护与开发有限公司 | Data deployment system with automatic screening and backup functions |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101604408B (en) | 2011-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101604408B (en) | Generation of detectors and detecting method | |
| CN108965245B (en) | Phishing website detection method and system based on self-adaptive heterogeneous multi-classification model | |
| Li et al. | A hybrid malicious code detection method based on deep learning | |
| CN102346829B (en) | Virus detection method based on ensemble classification | |
| CN108132929A (en) | A kind of similarity calculation method of magnanimity non-structured text | |
| CN109788079A (en) | DGA domain name real-time detection method and device | |
| CN102571768B (en) | Detection method for phishing site | |
| CN103617290B (en) | Chinese machine-reading system | |
| CN112217787B (en) | Method and system for generating mock domain name training data based on ED-GAN | |
| CN109450845A (en) | A kind of algorithm generation malice domain name detection method based on deep neural network | |
| MX2011005771A (en) | Method and device for intercepting spam. | |
| CN105760762B (en) | A kind of unknown malicious code detecting method of embeded processor | |
| CN107315956A (en) | A kind of Graph-theoretical Approach for being used to quick and precisely detect Malware on the zero | |
| CN111460818A (en) | Web page text classification method based on enhanced capsule network and storage medium | |
| CN106055539A (en) | Name disambiguation method and apparatus | |
| CN115577248A (en) | Fault diagnosis system and method for wind generating set | |
| CN113269228B (en) | Method, device and system for training graph network classification model and electronic equipment | |
| CN105024987A (en) | Web service log monitoring method and apparatus | |
| CN103455597A (en) | Distributed information hiding detection method facing mass web images | |
| CN113626812A (en) | Machine learning Trojan horse detection method based on structural feature screening and load expansion | |
| Wang et al. | A malicious URL detection model based on convolutional neural network | |
| CN107315995A (en) | A kind of face identification method based on Laplce's logarithm face and convolutional neural networks | |
| CN103324886A (en) | Method and system for extracting fingerprint database in network intrusion detection | |
| Jhansi et al. | Improved Accuracy in Speech Recognition System for Detection of COVID-19 using Support Vector Machine and Comparing with Convolution Neural Network Algorithm | |
| CN113705099A (en) | Social platform rumor detection model construction method and detection method based on contrast learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20111116 Termination date: 20170403 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |