A detector generation method based on particle swarm optimization

Abstract

The present invention discloses a detector generation method based on particle swarm optimization, which includes the following steps: setting the center points of each face and edge of the antigen space as the global optimal position, continuously updating the global optimal position so that the movement route of the particle covers the entire space, repeatedly executing the particle swarm optimization algorithm until all the global optimal position points are traversed, and generating effective detectors to cover the non-self space; the second stage: if the expected coverage rate is reached, then terminate. Otherwise, generate a part of the detectors to cover the holes to achieve the expected coverage rate. The present invention solves the problem of long algorithm time and low detection rate caused by the randomness of the negative selection algorithm by introducing the particle swarm optimization algorithm; through experimental verification and analysis, compared with other algorithms RNSA, V-Detector, BIORV-NSA and ADC-NSA, DGA-PSO ranks first in detector training time and detection rate on four data sets.

Description

Technical Field

[0001] The present invention relates to a detector generation method based on particle swarm optimization, and belongs to the technical field of computer security. Background Art

[0002] The artificial immune system (AIS) utilizes artificial immune theory, abstracted from the biological immune system. The negative selection algorithm (NSA) is a key algorithm in artificial immune theory that can detect anomalies. However, NSA generates detectors randomly, resulting in redundant detectors, long algorithm runtime, and low detection rates.

[0003] The V-detector algorithm is the most classic improvement algorithm to the NSA algorithm. Its process mainly includes two stages: mature detector generation and anomaly detection.

[0004] Detector generation phase: randomly generate a detector d, and according to the NSA idea, ensure that it does not fall within any self-sample radius r s If d is within , then d is a mature detector. Calculate the minimum Euclidean distance P between d and all self-samples min , its detection radius R d =P min-rs Anomaly detection stage: Calculate the Euclidean distance between the sample to be tested and the mature detector generated in the previous step. If it is less than the detector radius, it means it is an anomaly sample.

[0005] The V-detector algorithm also has its own flaws. First, detectors are initially generated randomly, resulting in low efficiency and no guarantee of generating high-quality detectors with a wide detection range. Second, there is a risk that too many detectors will be generated, causing significant redundancy and poor algorithm performance; or too few detectors will be generated, resulting in a large number of black holes and a high false alarm rate. Even if a threshold is used to limit the number of detectors, the distribution of detectors is difficult to control, which can easily lead to excessive redundancy in some areas or sparse distribution of detectors, resulting in detection failure. Summary of the Invention

[0006] In order to overcome the defects in the prior art, the present invention aims to provide a detector generation method based on particle swarm optimization, which is used to solve the problem that the existing NSA generates detectors in a random manner, resulting in redundant detectors, making the algorithm run time longer and the detection rate lower.

[0007] The present invention provides a technical solution to solve the above technical problems: a detector generation method based on particle swarm optimization, comprising the following steps:

[0008] Step S101: Initialize in the antigen space and set the initial position of the particle P is the center point of the antigen space, and the initial velocity is V , the global best position gbest Set as the center of each edge and face of the antigen space;

[0009] Step S102: Calculate the initial fitness value of each particle according to the fitness function;

[0010] Step S103: Initial position P , the initial fitness value is used as the initial local optimal position and optimal fitness value of the particle;

[0011] Step S104: According to the global optimal position set in step S101 gbest , update the particle position , while updating the speed And the fitness value ;

[0012] Step S105: Based on the result obtained in step S104, determine whether to update the local optimal position and optimal fitness value of the particle through comparison;

[0013] Step S106: Determine whether the number of iterations has been reached. If not, repeat the update operation steps S104 and S105 until the number of iterations has been reached. The local optimal position corresponding to each particle is used as the mature detector center, and the optimal fitness value is used as the mature detector radius, and the particles are added to the detector set.

[0014] Step S107: Determine whether all global optimal positions have been traversed. If not, return to step S101 and execute again until all global optimal positions have been traversed.

[0015] Step S108, determine whether the expected coverage is achieved; if not, mutate the detector generated in step S106 as a new initial particle swarm, and execute step S102 again until the expected coverage is achieved.

[0016] A further technical solution is that the calculation formula in step S102 is:

[0017]

[0018] Where: p i Indicates the i The position of the particle, x m Indicates the m The particle is obtained by calculating the Euclidean distance. iThe closest position to the self-point is where the self-tolerance process is performed.

[0019] A further technical solution is that the updating formula of the particles in step S104 is:

[0020]

[0021]

[0022] Where: It is a particle i After updating in the current iteration d Dimensional speed; w Indicates the inertia weight, the value of the first iteration is 0.9, and the value of the final iteration is 0.4; c1 is the local learning factor, c2 is the global learning factor, set c1=c2=2; rand() represents a random number, Represents particles i In the kth iteration d The local best position value of the dimension, gbest d Indicates the global best position in d The value of the dimension; Indicates the i The particle in k The position of the first iteration d Dimension value, Represents the updated particle i In the d The value of the dimension.

[0023] A further technical solution is that in step S105, if the particle's latest fitness value is Greater than the local optimal fitness value obtained in the previous iteration , then update the local optimal fitness , and update the local optimal position at the same time .

[0024] A further technical solution is that the update formula in step S105 is:

[0025]

[0026]

[0027] Where: Represents the updated particle i In the d The value of the dimension.

[0028] A further technical solution is that the variation formula in step S108 is:

[0029]

[0030] Where: D id Indicates the d-th dimension value of the i-th detector in the detector set, rand() represents a random number, is the disturbance factor, which is used to control the variation within the neighborhood and is set to 0.4.

[0031] A further technical solution is to set the global learning factor to 0 and the number of global optimal positions to 0 in step S108; and then start executing step S102.

[0032] The present invention has the following beneficial effects: the present invention solves the problems of long algorithm time and low detection rate caused by the randomness of the negative selection algorithm by introducing the particle swarm optimization algorithm; through experimental verification and analysis, compared with other algorithms RNSA, V-Detector, BIORV-NSA and ADC-NSA, DGA-PSO ranks first in detector training time and detection rate on four data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Flowchart of the present invention. Implementation Method

[0034] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0035] like Figure 1 As shown in FIG, a detector generation method based on particle swarm optimization of the present invention mainly includes two stages:

[0036] Phase 1: Detector generation. The tolerance process is converted into an adaptation function to calculate the Euclidean distance to guide the particles to move in a specific direction by manually setting the global optimal position. The center points of each surface in the antigen space are set as the global optimal position. By continuously updating the global optimal position, the particle movement route covers the entire space. The particle swarm optimization algorithm is repeatedly executed until all global optimal positions are traversed, that is, the movement process in all directions is completed, an effective detector is generated to cover the non-self space, and the redundancy of the generated detectors is reduced.

[0037] Phase 2: If the desired coverage is achieved in Phase 1, the process terminates. Otherwise, a mutation operation is performed, using the detectors generated in the generation phase as initial particles and generating a subset of detectors to cover the holes and achieve the desired coverage, thereby improving the detection rate.

[0038] The specific steps include:

[0039] 101. Initialize in the antigen space and set the initial position of the particle is the center point of the antigen space, and the initial velocity is , the global best position Set as the center of each edge and face of the antigen space;

[0040]

[0041]

[0042]

[0043] Where: d Indicates the antigen space dimension, and the particle speed is controlled at 20% of the space it is in;

[0044] 102. Calculate the initial fitness value of each particle according to the fitness function;

[0045]

[0046] Where: p i represents the position of the i-th particle, x m Represents the mth self-point. Through Euclidean distance calculation, the closest position of particle i to the self-point is obtained, that is, the self-tolerance process is executed;

[0047] 103. Use the initial position and initial fitness value as the initial local optimal position of the particle , the best fitness value ;

[0048]

[0049]

[0050] 104. Update the particle position according to the global optimal position set in step 101 , while updating the speed And the fitness value ;

[0051]

[0052]

[0053] Where: It is a particle i After updating in the current iteration d Dimensional speed; wIndicates the inertia weight, the value of the first iteration is 0.9, and the value of the final iteration is 0.4; c1 is the local learning factor, c2 is the global learning factor, set c1=c2=2; rand() represents a random number, Represents particles i In the kth iteration d The local best position value of the dimension, gbest d Indicates the global best position in d The value of the dimension; Indicates the i The particle in k The position of the first iteration d Dimension value, Represents the updated particle i In the d The value of the dimension;

[0054] 105. Based on the results obtained in 104, decide whether to update the local optimal position and optimal fitness value of the particle through comparison;

[0055]

[0056]

[0057] If the particle's latest fitness value Greater than the local optimal fitness value obtained in the previous iteration , then update the local optimal fitness , and update the local optimal position at the same time ;

[0058] 106. Determine whether the number of iterations has been reached. If not, repeat the update operations 104 and 105. If the number of iterations has been reached, use the local optimal position corresponding to each particle as the mature detector center and the optimal fitness value as the mature detector radius, and add the particles to the detector set.

[0059] 107. Determine whether all global optimal positions have been traversed. If not, return to 101 and execute again.

[0060] After the first stage, we can obtain some detectors that cover all directions of the antigen space, but there may still be some non-self space that is not covered by the detectors;

[0061] Therefore, by calculating the detector coverage at this time, we can determine whether the termination condition is met. If the coverage does not reach the set threshold, we will execute the second stage, mutate the newly added detector, use it as the new initial particle swarm, and set the global optimal learning factor to When it is 0, the global optimization behavior is canceled and the particles are moved within the neighborhood of the existing detectors to fill the uncovered non-self space;

[0062] 201. Determine whether the expected coverage is achieved. If so, the algorithm is executed.

[0063] 202. If the expected coverage is not achieved, the second stage of the algorithm is carried out, and the detectors generated in the first stage are used as the initial set of information for mutation;

[0064] Where: D id Indicates the d-th dimension value of the i-th detector in the detector set, rand() represents a random number, is the disturbance factor, which is used to control the variation within the neighborhood and is set to 0.4;

[0065] 203. Set the global learning factor to 0 and the number of global optimal positions to 0; then start again from 102.

[0066] The above description does not limit the present invention in any form. Although the present invention has been disclosed through the above embodiments, it is not intended to limit the present invention. Any technician familiar with the profession can use the technical content disclosed above to make some changes or modifications to equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A detector generation method based on particle swarm optimization, characterized in that: The following steps are involved: Step S101: Initialize in the antigen space and set the initial position of the particle P is the center point of the antigen space, and the initial velocity is V , the global best position gbest Set as the center of each edge and face of the antigen space; Step S102: Calculate the initial fitness value of each particle according to the fitness function; Step S103: Initial position P , the initial fitness value is used as the initial local optimal position and optimal fitness value of the particle; Step S104: According to the global optimal position set in step S101 gbest , update the particle position , while updating the speed And the fitness value ; Step S105: Based on the result obtained in step S104, determine whether to update the local optimal position and optimal fitness value of the particle through comparison; Step S106: Determine whether the number of iterations has been reached. If not, repeat the update operation steps S104 and S105 until the number of iterations has been reached. The local optimal position corresponding to each particle is used as the mature detector center, and the optimal fitness value is used as the mature detector radius, and the particles are added to the detector set. Step S107: Determine whether all global optimal positions have been traversed. If not, return to step S101 and execute again until all global optimal positions have been traversed. Step S108, determine whether the expected coverage is achieved; if not, mutate the detector generated in step S106 as a new initial particle swarm, and execute step S102 again until the expected coverage is achieved.

2. The detector generation method based on particle swarm optimization according to claim 1, characterized in that: The calculation formula in step S102 is: Where: p i Indicates the i The position of the particle, x m Indicates the m A self point.

3. The detector generation method based on particle swarm optimization according to claim 1, characterized in that: The updating formula of the particles in step S104 is: Where: It is a particle i After updating in the current iteration d Dimensional speed; w Indicates inertia weight; c1 is the local learning factor; c2 is the global learning factor; rand() represents a random number, Represents particles i The local best position value of the d-th dimension in the k-th iteration; gbest d Indicates the global best position in d The value of the dimension; Indicates the i The particle in k The position of the first iteration d Dimension value; Represents the updated particle i In the d The value of the dimension.

4. The detector generation method based on particle swarm optimization according to claim 1, characterized in that: In step S105, if the particle's latest fitness value Greater than the local optimal fitness value obtained in the previous iteration , then update the local optimal fitness , and update the local optimal position at the same time .

5. The detector generation method based on particle swarm optimization according to claim 4, characterized in that: The update formula in step S105 is: Where: Indicates that the updated particle i is in the d The value of the dimension.

6. The detector generation method based on particle swarm optimization according to claim 1, characterized in that: The variation formula in step S108 is: Where: D id represents the number of the i-th detector in the detector set d Dimension value, rand() represents a random number, is the disturbance factor.

7. The detector generation method based on particle swarm optimization according to claim 1, characterized in that: In step S108 , the global learning factor is set to 0 and the number of global optimal positions is set to 0; and then step S102 is started.

Images