Method, system, medium and equipment for compressed network traffic anomaly detection based on dynamic evolution of immune detector

Abstract

The application discloses a kind of based on immune detector dynamic evolution's compressed network flow anomaly detection method and system, comprising: (1) general compressed algorithm identification module, utilizes compressed header information to identify the compressed algorithm used.(2) based on the feature selection module of mixed filtering type parcel type, the importance of network traffic features is calculated from multiple angles and the optimal feature subset is selected.(3) candidate self-detector generation and evolution tolerance module, directly generate candidate self-detector on the basis of self, and quickly complete evolution tolerance with the help of antigen clustering feature tree.(4) based on the mature tolerance module of candidate self-detector of Monte Carlo, the coverage of candidate self-detector is calculated with the help of Monte Carlo algorithm, and the candidate self-detector that is cooperatively covered by multiple mature self-detectors and has larger coverage area is removed.(5) use mature self-detector to detect anomalies in compressed network traffic.The application can realize the efficient and accurate detection of abnormal data.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method and system for detecting anomalies in compressed network traffic based on the dynamic evolution of an immune detector. Background Technology

[0002] With the rapid development of internet and cloud computing technologies, the number of connected devices worldwide has reached an astonishing scale. However,

[0003] In such a large-scale network infrastructure, network attacks and equipment failures occur frequently, resulting in poor internet experiences and significant economic losses for users. Meanwhile, compressing network traffic can not only improve transmission speed but also reduce bandwidth consumption, and more and more applications are adopting compressed traffic for communication. Therefore, accurately and efficiently detecting anomalies in compressed network traffic is of great importance.

[0004] In real-world network environments, system vulnerabilities always exist. Hackers and malicious actors exploit these vulnerabilities to gain illicit profits, transforming previously permitted normal network activities into offensive attacks. Furthermore, as time progresses, service providers may open new ports and offer more application functionalities to provide better services, allowing previously prohibited network behaviors. However, existing anomaly detection methods often employ static assessments. While these methods can provide a rough risk assessment of the network's long-term state, they are somewhat cumbersome in dealing with real-time evolving network environments, lacking sufficient adaptability and dynamic evolution capabilities.

[0005] Therefore, it can be seen that the existing methods have the technical problem of poor detection effect. Summary of the Invention

[0006] To address the issue of large network traffic volumes and the poor performance of static anomaly detection methods in real-time network environments, this invention applies a dynamic evolution approach based on artificial immunity to anomaly detection in compressed network traffic. This effectively identifies the specific compression algorithm used in the compressed traffic and further detects current network attacks, achieving optimal network detection response and improving system security. This invention provides a compressed network traffic anomaly detection method based on the dynamic evolution of an immune detector.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] The first aspect provides a compressed network traffic anomaly detection method based on the dynamic evolution of immune detectors, including:

[0009] S1: Identify the specific compression algorithm used in the compressed traffic by using the header field of the compressed data packet, decompress the compressed data packet using the identified compression algorithm, and extract the network traffic characteristics from it;

[0010] S2: Employ a hybrid filtering embedded feature selection technique to measure the importance of extracted network traffic features from multiple perspectives, and further use a weighted voting method to integrate the importance of the features measured from multiple perspectives. Finally, use a recursive feature accumulation strategy to select the optimal feature subset.

[0011] S3: Based on the optimal feature subset sample space obtained in step S2, hierarchical clustering is performed on the antigen training set, and an antigen cluster feature tree is constructed; candidate self-detectors are generated using autoantigens, and evolutionary tolerance between candidate self-detectors and non-autoantigens is completed based on the antigen cluster feature tree. The nodes in the antigen cluster feature tree are represented by the format of a quadruple <linear sum of antigen positions, sum of squares of antigen positions, set of autoantigen indexes, set of non-antigen indexes>. Antigens include autoantigens and non-autoantigens. Autoantigens represent normal network activity, and non-autoantigens represent abnormal or illegal network activity.

[0012] S4: Based on the position and radius relationship between the candidate self detector and the mature self detector set, further complete the maturity tolerance of the candidate self detector and add the retained candidate self detector to the mature self detector set.

[0013] S5: Calculate the affinity between the mature self-detectors in the mature self-detector set and the unknown antigens in the test set. If the unknown antigen can be recognized by the mature self-detectors, it is considered to be an autoantigen; otherwise, it is considered to be a non-autoantigen.

[0014] In one implementation, step S1 involves identifying the specific compression algorithm used by the compressed traffic using the header field of the compressed data packet, including:

[0015] The ID1, ID2, and CM headers are used to identify the gzip compression algorithm, where ID1 is a fixed value of 0x1f, ID2 is a fixed value of 0x8b, and CM represents the compression algorithm. A CM of 8 indicates the commonly used deflate algorithm.

[0016] Use the CMF and FLG headers to identify the zlib compression algorithm, where CMF is 0x78 to indicate the use of the deflate algorithm and FLG is 0x9c to indicate the use of the maximum compression level.

[0017] Use the character 'BZ' to identify network traffic compressed with bzip2;

[0018] Use headers from the xz compression algorithm to identify xz compressed network traffic;

[0019] Use the character 'Rar' to identify network traffic compressed with rar.

[0020] In one implementation, step S2 includes:

[0021] Feature selection techniques based on the coefficient of variation, Pearson correlation coefficient, random forest, and gradient boosting decision tree algorithms are used to measure feature importance from the perspectives of feature divergence, feature-label correlation, and correlation between features.

[0022] A weighted voting strategy is used to assign different weights to the above feature selection techniques, and the final importance of each feature is further calculated.

[0023] The optimal feature subset under the condition of the highest network anomaly detection rate is calculated by adopting a recursive feature accumulation strategy.

[0024] In one implementation, step S3 includes:

[0025] Using the optimal feature subset obtained in step S2, hierarchical clustering is performed on the antigen training set, and an antigen cluster feature tree is gradually constructed based on the clustering results.

[0026] Candidate self-detectors are directly generated by using the self-antigens in the leaf nodes of the antigen clustering feature tree;

[0027] By leveraging the fast indexing properties of antigen clustering feature trees, specific non-self sets that are tolerant to the current candidate autodetector are identified.

[0028] Evolutionary tolerance of candidate self-detectors is achieved by calculating the affinity between candidate self-detectors and specific non-self sets.

[0029] In one implementation, step S4 includes:

[0030] Calculate the distance between the candidate autodetector and the mature autodetector, and obtain the radius of the candidate autodetector and the mature autodetector. If the distance between the candidate autodetector and all mature autodetectors is greater than the sum of the radii, then the candidate autodetector is considered not to be covered by any mature autodetector, and it is added to the mature autodetector set. If the distance between the candidate autodetector and any mature autodetector is less than the difference of their radii, then the candidate autodetector is considered to be completely covered by mature autodetectors, and it is discarded. If neither of the above two conditions is met, then the candidate autodetector is considered to be partially covered by mature autodetectors. The Monte Carlo random point estimation algorithm is used to calculate the specific coverage maturity and determine whether to retain it.

[0031] In one implementation, step S5 includes:

[0032] Using the mature self-detector set generated in step S4, calculate the Euclidean distance between the mature self-detector set and the unknown antigen, which is used as the affinity between the mature antibody and the unknown antigen. If the distance from the unknown antigen to a certain mature self-detector is less than the radius of the mature self-detector, that is, the unknown antigen is recognized by a certain mature antibody, then the antigen is considered to be an autoantigen. If the unknown antigen is not recognized by any mature antibody, then it is classified as a non-autoantigen.

[0033] Based on the same inventive concept, a second aspect of the present invention provides a compressed network traffic anomaly detection system based on the dynamic evolution of an immune detector, comprising:

[0034] The general compressed traffic identification module is used to identify the specific compression algorithm used in compressed traffic by utilizing the header field of compressed data packets, decompress the compressed data packets using the identified compression algorithm, and extract the network traffic characteristics therein.

[0035] The feature selection module is used to measure the importance of extracted network traffic features from multiple perspectives using a hybrid filtering embedded feature selection technology. It further uses a weighted voting method to integrate the importance of the features measured from multiple perspectives, and finally uses a recursive feature accumulation strategy to select the optimal feature subset.

[0036] The candidate self-detector generation and evolutionary tolerance module is used to perform hierarchical clustering on the antigen training set based on the optimal feature subset sample space obtained by the feature selection module, and construct an antigen clustering feature tree. It generates candidate self-detectors using autoantigens and completes the evolutionary tolerance of candidate self-detectors with non-autoantigens based on the antigen clustering feature tree. The nodes in the antigen clustering feature tree are represented by the format of a quadruple <linear sum of antigen positions, square sum of antigen positions, set of autoantigen indexes, set of non-antigen indexes>. Antigens include autoantigens and non-autoantigens. Autoantigens represent normal network activity, and non-autoantigens represent abnormal or illegal network activity.

[0037] The candidate self-detector maturation tolerance module is used to further complete the maturation tolerance of candidate self-detectors based on the position and radius relationship between candidate self-detectors and the mature self-detector set, and add the retained candidate self-detectors to the mature self-detector set.

[0038] The mature self-detector anomaly detection module is used to calculate the affinity between the mature self-detectors in the mature self-detector set and the unknown antigens in the test set. If the unknown antigen can be recognized by the mature self-detectors, it is considered to be an autoantigen; if it cannot be recognized, it is considered to be a non-autoantigen.

[0039] In one implementation, the candidate self-detector generation module is specifically used for:

[0040] The optimal feature subset obtained by the feature selection module is used to perform hierarchical clustering on the antigen training set, and the antigen clustering feature tree is gradually constructed based on the clustering results.

[0041] Candidate self-detectors are directly generated by using the self-antigens in the leaf nodes of the antigen clustering feature tree;

[0042] By leveraging the fast indexing properties of antigen clustering feature trees, specific non-self sets that are tolerant to the current candidate autodetector are identified.

[0043] Evolutionary tolerance of candidate self-detectors is achieved by calculating the affinity between candidate self-detectors and specific non-self sets.

[0044] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in the first aspect.

[0045] Based on the same inventive concept, a fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0046] Compared with the prior art, the technical solution provided by the present invention has at least the following technical effects:

[0047] This invention leverages the self-organizing, adaptive, and dynamically adjusting characteristics of the artificial immune system. By simulating the positive selection process of human B cells, it adaptively generates candidate self-detectors to overcome the hole problem in the training process of traditional detectors. Furthermore, it employs hierarchical clustering to improve detector training efficiency and utilizes a Monte Carlo coverage estimation algorithm to achieve accurate tolerance of candidate self-detectors, thereby reducing the training time of the immune detector and improving its anomaly detection accuracy. Simultaneously, through a hybrid filtering and wrapper-style feature selection algorithm (based on hybrid filtering embedded feature selection technology), it reduces the feature dimensionality of the training set, avoiding the dimensionality curse problem in the immune detector training process. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a simplified flowchart of a compressed network traffic anomaly detection based on the dynamic evolution of an immune detector, provided by an embodiment of the present invention.

[0050] Figure 2 This is a schematic diagram of the overall process for detecting anomalies in compressed network traffic based on the dynamic evolution of an immune detector, provided by an embodiment of the present invention.

[0051] Figure 3 This is a flowchart of a feature selection process based on a hybrid filtering and wrapping method provided in an embodiment of the present invention.

[0052] Figure 4 This is a flowchart of candidate self-detector generation and evolution tolerance based on antigen clustering feature tree provided in the embodiments of the present invention.

[0053] Figure 5 This is a schematic diagram of an antigen clustering feature tree provided in an embodiment of the present invention.

[0054] Figure 6 This is provided by the embodiments of the present invention. Figure 5 The corresponding antigen clustering diagram.

[0055] Figure 7 This is a flowchart of the maturity tolerance process of a candidate self-detector based on the Monte Carlo algorithm provided in an embodiment of the present invention.

[0056] Figure 8 This is a schematic diagram showing the coverage and radius relationship between candidate self-detectors and mature self-detectors provided in an embodiment of the present invention. Detailed Implementation

[0057] Through extensive research and practice, the inventors of this application have discovered that the security problems of computer networks and the defense of biological immune systems against external viruses share striking similarities. Inspired by biological immunity, artificial immune systems possess characteristics such as self-organization, self-adaptation, dynamic feedback, and distribution. Furthermore, because they simulate the evolutionary characteristics of biological immune systems, they can naturally describe the dynamic evolution of immune detectors over time in real-world network environments, such as when a system administrator decides to temporarily cancel certain network services, close some ports, or provide new services. Moreover, the compressed traffic anomaly detection method based on artificial immunity can evolve in real time, making it easier to address issues such as zero-day attacks. In addition, addressing the problems of dimensionality curse, holes, and low tolerance efficiency encountered in the training process of traditional immune detectors, this invention further solves and optimizes these issues by combining antigen clustering feature trees with Monte Carlo algorithms.

[0058] Specifically, in order to solve the problems that traditional anomaly detection methods cannot cope with real-time changes in network environment and are difficult to adapt to new attack methods, this invention applies the dynamic evolution idea based on artificial immunity to the anomaly detection of compressed network traffic. It effectively identifies the compression algorithm used in compressed traffic and further detects the current network attack, achieving optimal network detection response and further improving system security. This invention proposes a compressed traffic anomaly detection method and system based on the dynamic evolution of immune detectors. The system includes: (1) a general compression algorithm identification module based on compressed data packet header matching, which uses the packet header information of compressed packets to quickly identify the compression algorithm used by the compressed packets. (2) a feature selection module based on hybrid filtering and wrapping, which uses feature selection algorithms with different strategies to calculate the feature importance of network traffic features from multiple perspectives. Then, a weighted voting-based aggregation strategy is used to synthesize the above feature importance. Finally, a recursive accumulation method is used to find the optimal feature subset. (3) The candidate self-detector generation and evolution tolerance module based on antigen clustering first performs hierarchical clustering of antigens and constructs an antigen clustering feature tree. Then, it directly generates candidate self-detectors using the self-antigens in the leaf nodes of the antigen clustering feature tree. Finally, it uses the characteristic of the antigen clustering feature tree as a fast index of B+ tree to quickly lock some non-self-antigens that are evolutionarily tolerant to the candidate self-detectors, thus achieving fast and accurate evolution tolerance of candidate self-detectors. (4) The candidate self-detector maturation module based on Monte Carlo algorithm first uses the relationship between the radius of the candidate self-detector and the mature self-detector and the distance between them to initially determine whether the candidate self-detector is covered. Then, for the candidate self-detectors that are partially covered by the mature self-detectors, the Monte Carlo algorithm is used to further determine the degree of coverage. Based on the different degrees of coverage, it is determined whether to add the candidate self-detector to the set of mature self-detectors. (5) The anomaly detection module using mature self-detectors detects compressed network traffic based on the above-mentioned compressed network traffic identification method and the above-generated mature self-detectors to identify abnormal behavior in network activities.

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Example 1

[0061] 1. A compressed network traffic anomaly detection method based on dynamic evolution of immune detectors, including:

[0062] S1: Identify the specific compression algorithm used in the compressed traffic by using the header field of the compressed data packet, decompress the compressed data packet using the identified compression algorithm, and extract the network traffic characteristics from it;

[0063] S2: Employ a hybrid filtering embedded feature selection technique to measure the importance of extracted network traffic features from multiple perspectives, and further use a weighted voting method to integrate the feature importance measured from the above multiple perspectives. Finally, use a recursive feature accumulation strategy to select the optimal feature subset.

[0064] S3: Based on the optimal feature subset sample space obtained in step S2, hierarchical clustering is performed on the antigen training set, and an antigen cluster feature tree is constructed; candidate self-detectors are generated using autoantigens, and evolutionary tolerance between candidate self-detectors and non-autoantigens is completed based on the antigen cluster feature tree. The nodes in the antigen cluster feature tree are represented by the format of a quadruple <linear sum of antigen positions, sum of squares of antigen positions, set of autoantigen indexes, set of non-antigen indexes>. Antigens include autoantigens and non-autoantigens. Autoantigens represent normal network activity, and non-autoantigens represent abnormal or illegal network activity.

[0065] S4: Based on the position and radius relationship between the candidate self detector and the mature self detector set, further complete the maturity tolerance of the candidate self detector and add the retained candidate self detector to the mature self detector set.

[0066] S5: Calculate the affinity between the mature self-detectors in the mature self-detector set and the unknown antigens in the test set. If the unknown antigen can be recognized by the mature self-detectors, it is considered to be an autoantigen; otherwise, it is considered to be a non-autoantigen.

[0067] Please see Figure 1 This is a simplified flowchart illustrating an anomaly detection method for compressed network traffic based on the dynamic evolution of an immune detector, provided by an embodiment of the present invention.

[0068] Overall, step S1 is a general compression algorithm identification module based on compressed packet headers. Step S2 is a hybrid filtering and wrapper-style feature selection module. Step S3 is a candidate self-detector generation and evolution tolerance module based on antigen hierarchical clustering. Step S4 is a collaborative coverage evaluation and maturity tolerance module based on Monte Carlo multi-mature self-detectors. Step S5 is a compressed network traffic anomaly detection module based on compressed traffic identification technology and mature self-detector sets.

[0069] In the specific implementation process, step S2 uses the network traffic feature set obtained in step S1 to perform multi-angle feature importance evaluation and calculate the optimal feature subset. Step S3, based on the feature subset selected in step S2, utilizes the spatial distance between antigens to perform hierarchical clustering of antigens and gradually constructs an antigen clustering feature tree. Combining the self-antigen positions of the leaf nodes of the antigen clustering feature tree, candidate self-detectors are directly generated. Then, using the proximity relationships of antigens in the antigen clustering feature tree, rapid and efficient evolution tolerance of candidate self-detectors is achieved. Step S4, based on the candidate self-detectors generated in S3, calculates the positional relationship between the mature self-detector set and the current candidate self-detector set, and further determines whether a candidate self-detector is mature or discarded. Candidate self-detectors largely covered by mature self-detectors are removed, and the tolerated candidate self-detectors are retained. Step S5, based on all the above steps, uses compressed network traffic identification technology to identify and decompress compressed traffic, and uses the generated mature self-detector set to perform anomaly detection on network traffic.

[0070] It should be noted that in the artificial immune system, antigens are divided into two types: autoantigens and non-autoantigens. Autoantigens represent normal network activity, while non-autoantigens represent abnormal or illegal network activity. Candidate self-detectors are initially generated detectors that have not undergone evolution and maturation; mature self-detectors are detectors that have survived the evolution and tolerance process of candidate self-detectors. Detectors are also called antibodies in the artificial immune system. The network anomaly detection process is the process of antibody matching with external antigens.

[0071] Please see Figure 2 This is a schematic diagram of the overall process for detecting anomalies in compressed network traffic based on the dynamic evolution of an immune detector, provided by an embodiment of the present invention.

[0072] In one implementation, step S1 involves identifying the specific compression algorithm used by the compressed traffic using the header field of the compressed data packet, including:

[0073] The ID1, ID2, and CM headers are used to identify the gzip compression algorithm, where ID1 is a fixed value of 0x1f, ID2 is a fixed value of 0x8b, and CM represents the compression algorithm. A CM of 8 indicates the commonly used deflate algorithm.

[0074] Use the CMF and FLG headers to identify the zlib compression algorithm, where CMF is 0x78 to indicate the use of the deflate algorithm and FLG is 0x9c to indicate the use of the maximum compression level.

[0075] Use the character 'BZ' to identify network traffic compressed with bzip2;

[0076] Use headers from the xz compression algorithm to identify xz compressed network traffic;

[0077] Use the character 'Rar' to identify network traffic compressed with rar.

[0078] Specifically, in the captured network traffic, the header information of the traffic data packets is checked to determine whether the traffic has been compressed. This is because compressed network traffic is similar to file format and usually needs to have special header information added before transmission. Furthermore, different compression algorithms have different header information. The specific compression algorithm used is identified by its unique magic number. For example: the ID1 ID2 CM header identifies the gzip compression algorithm, where ID1 is a fixed value of 0x1f, ID2 is a fixed value of 0x8b, and CM represents the compression algorithm; CM=8 indicates the commonly used deflate algorithm. The CMF FLG header identifies the zlib compression algorithm, where CMF=0x78 indicates the deflate algorithm is used, and FLG=0x9c indicates the maximum compression level is used. bzip2 does not have a fixed compression format, but it uses 'BZ' as its magic number; therefore, the character 'BZ' is used to identify network traffic compressed by bzip2. The xz compression algorithm's Header Magic Bytes header identifies xz compressed network traffic; the Header Magic Bytes value is a fixed hexadecimal value \xfd\x37\x7a\x58\x5a\x00. The character 'Rar' is used to identify network traffic compressed by rar. It should be noted that the magic number of a compression algorithm is a unique value located in the first few bytes of each file. It is a constant numeric or text value used to indicate the file type, identify the file format, or protocol.

[0079] In one implementation, step S2 includes:

[0080] Feature selection techniques based on the coefficient of variation, Pearson correlation coefficient, random forest, and gradient boosting decision tree algorithms are used to measure feature importance from the perspectives of feature divergence, feature-label correlation, and correlation between features.

[0081] A weighted voting strategy is used to assign different weights to the above feature selection techniques, and the final importance of each feature is further calculated.

[0082] The optimal feature subset under the condition of the highest network anomaly detection rate is calculated by adopting a recursive feature accumulation strategy.

[0083] Please see Figure 3 This is a flowchart of the hybrid filtering wrap-around feature selection algorithm provided in the embodiments of the present invention.

[0084] Specifically, different feature selection algorithms are first used from different perspectives of network traffic characteristics, including: (1) using the coefficient of variation to determine the degree of divergence of the features themselves. The evaluation is conducted using the following formula:

[0085]

[0086] in, Representing data standard deviation data The mean.

[0087] (2) Regarding the correlation between features and targets, one filtering strategy (Pearson correlation coefficient) and two wrapping strategies (XGBoost and Random Forest) are adopted, and their calculation formulas are shown below. The feature importance of network traffic features is calculated using the above feature selection methods.

[0088]

[0089]

[0090]

[0091] in, This represents the feature importance value calculated using the Pearson correlation coefficient. Representation of features With tags Covariance between , Representing features respectively and tags standard deviation , They represent , , , , The mathematical expectation, This represents the feature importance value calculated by the random forest. Indicates the normalized i-th The feature importance value of the tree, Indicates the first The importance value of the features of the tree. In the j-th tree, the first... The importance value of each feature, This represents the number of all trees. This represents the feature importance value calculated by XGBoost. Represents the set of all trees. It represents the set of all features.

[0092] Next, a weighted voting strategy is used to summarize the results. Since the coefficient of variation reflects the degree of feature divergence, is calculated within the feature data column, and the scores of different features do not differ significantly, it is assigned a smaller weight. The remaining weights are equally distributed among the other three feature selection algorithms, ensuring that the total weight sum is 1. The calculation formula is as follows.

[0093]

[0094] in, , .

[0095] Finally, a recursive feature accumulation strategy is adopted to sort the total importance values ​​of the features obtained above. A classifier is then trained, and in each round of training, the feature with the highest current importance value is added sequentially. The detector is then retrained to obtain the classification result. After all features have been added to the set, the detection accuracy corresponding to different feature subsets is compared, and the feature subset with the highest accuracy is selected as the optimal feature subset.

[0096] In one implementation, step S3 includes:

[0097] Using the optimal feature subset obtained in step S2, hierarchical clustering is performed on the antigen training set, and an antigen cluster feature tree is gradually constructed based on the clustering results.

[0098] Candidate self-detectors are directly generated by using the self-antigens in the leaf nodes of the antigen clustering feature tree;

[0099] By leveraging the fast indexing properties of antigen clustering feature trees, specific non-self sets that are tolerant to the current candidate autodetector are identified.

[0100] Evolutionary tolerance of candidate self-detectors is achieved by calculating the affinity between candidate self-detectors and specific non-self sets.

[0101] Please see Figure 4 This is a flowchart of candidate self-detector generation and evolution tolerance based on antigen clustering feature tree provided in the embodiments of the present invention.

[0102] The process is mainly divided into two parts: (1) constructing an antigen clustering feature tree, and (2) generating candidate self-detectors and completing evolutionary tolerance.

[0103] (1) The construction of the antigen cluster feature tree includes the following steps:

[0104] First, three parameters need to be introduced during the construction of the antigen clustering feature tree, namely the branch balance factor. Leaf balance factor is used to control the number of child nodes contained in a branch node. Spatial threshold used to control the minimum number of clusters contained in a leaf node. This is used to control the size of the minimum cluster. Meanwhile, nodes in the antigen clustering feature tree are represented using a quadruple format: <linear sum of antigen positions, squared sum of antigen positions, set of self-antigen indices, set of non-antigen indices>, and this quadruple is called the ACF (antigen cluster feature). A pointer `child` to a child node is introduced in the root node; a pointer `parent` to the parent node and a pointer `child` to a child node are introduced in the branch nodes; and a pointer `prev` to the previous leaf node and a pointer `next` to the next leaf node are introduced in the leaf nodes to facilitate rapid indexing of specific antigens during the tolerance process of candidate autodetectors.

[0105] Figure 5 This is a schematic diagram of a constructed antigen clustering feature tree, showing its branch balance factor. A value of 2 indicates that the leaf can accommodate a maximum of 2 child nodes; leaf balance factor. A value of 3 indicates a maximum of 3 minimum clusters. Leaf nodes and the root node have only one level, while branch nodes can have an infinite number of levels. The information stored in each node is represented by a quadruple ACF. When a new antigen to be clustered appears, the first two parameters of the quadruple are used to calculate the nearest cluster for that antigen. For the specific determination method, please refer to the detailed calculation and derivation process of the existing Birch algorithm. The index values ​​of autoantigens and non-autoantigen samples in the database are stored in the remaining two parameters of the quadruple. They participate in the subsequent generation of autodetectors and the evolutionary maturation tolerance process. Storing only index information can reduce the consumption of computer memory resources. Figure 6 Is with Figure 5 An example diagram of clustering partitioning corresponding to the antigen clustering feature tree, where black dots represent self-samples and gray dots represent non-self-samples. The smallest cluster is shown in the diagram. , , , , , The cluster radii of these clusters are all smaller than the spatial threshold. The information stored in the root node, leaf node, and branch node of the antigen clustering feature tree is recorded in the form of quadruples. The root node, leaf node, and branch node represent clusters of different sizes. Large clusters can be formed by merging small clusters. The root node represents the complete set of antigen samples.

[0106] The construction process of the antigen clustering feature tree is as follows: First, a root node of the antigen clustering feature tree is constructed. Then, antigens are inserted into the nearest smallest cluster in sequence, ensuring that the distance from the antigen to the centroid of the smallest cluster does not exceed the spatial threshold. If the distance exceeds A new minimal cluster is then created to store the antigens to be clustered, and this new minimal cluster is inserted into the corresponding leaf node. It's worth noting that initially, the antigen clustering feature tree is empty; similarly, a new minimal antigen cluster needs to be created to store the antigens to be clustered, and this new minimal cluster is then inserted back into the leaf node. If the number of minimal clusters in a leaf node is greater than the leaf balance factor... If the leaf node is not properly split, the splitting process is as follows: First, identify the two furthest smallest clusters among the leaf nodes to be split and assign them to two newly created empty leaf nodes. Next, assign the remaining smallest clusters to the two newly created leaf nodes based on proximity. Finally, insert the two newly generated leaf nodes back into the parent node of the leaf node to be split, delete the old leaf node, and update the parent node's state. This operation may result in the parent node not satisfying the parameters. As for splitting, since the antigen clustering feature tree is a highly balanced multi-way search tree, it is a recursive problem that is processed until the root node of the antigen clustering feature tree is reached. The splitting process of the branch node is the same as that of the leaf node.

[0107] It's important to note that the antigen clustering feature tree stores information in quadruplets. When a new antigen needs to participate in clustering, it starts by determining which cluster it's closest to from the root node's child nodes, and then searches downwards until it finds the nearest cluster in a branch node and adds it. Antigen clusters can be large or small; multiple small clusters can form a large cluster. The root node is the largest cluster, containing all antigens. The current antigen object refers to performing operations on a specific antigen sample. Autologous and non-autologous antigen samples are stored in the last two parameters of the quadruplet using their index values ​​in the database.

[0108] (2) The process of generating and evolving tolerance of candidate self-detectors includes the following steps:

[0109] In the high-dimensional network traffic sample space, the immune detector is represented by a tuple <hypersphere center, hypersphere radius>. First, the center of the detector is determined. Using the forward and backward pointers of the leaf nodes, the minimum clusters of the antigen clustering feature tree are traversed sequentially. It is directly determined whether the minimum cluster contains autoantigens. If not, the process is skipped and the next minimum cluster is checked. If it contains autoantigens, the set of autoantigens in the current cluster is extracted. The position of the autoantigen in the sample space is used as the center of the candidate autodetector. The radius of the candidate autodetector is randomly determined to generate the initial candidate autodetector.

[0110] Next, the radius of the candidate autodetector needs to be adaptively optimized. This optimization requires evolutionary tolerance between the candidate autodetector and non-self antigens to avoid the detector radius being too large and covering non-self regions, or too small and failing to completely cover self regions. First, for the current candidate autodetector position, the specific set of non-self antigens is found using the antigen clustering feature tree. The process is as follows: It is checked whether the smallest cluster containing the current candidate autodetector also contains non-self antigens. If so, it means the candidate autodetector and non-self antigens are close in position and clustered in the same cluster, and the search for the specific non-self antigen node is complete. If not, a pointer to the parent node is used to search upwards in the antigen clustering feature tree until a branch node containing a non-empty non-self antigen is found. Then, a relaxation function is introduced to perform an upward relaxation (i.e., upward indexing) on ​​the selected node containing non-self antigens. (Multiple parent nodes) are used to expand the set of non-self antigens, thereby increasing the accuracy of tolerance. Finally, after finding a specific node containing non-self antigens, the specific set of non-self antigens in the target node is extracted, and the affinity with the candidate self detector is further calculated, i.e., the Euclidean distance is calculated, the minimum distance between the candidate self detector and the set of non-self antigens is found, and multiplied by 0.5 as the radius of the candidate self detector after evolution.

[0111] In one implementation, step S4 includes:

[0112] Calculate the distance between the candidate autodetector and the mature autodetector, and obtain the radius of the candidate autodetector and the mature autodetector. If the distance between the candidate autodetector and all mature autodetectors is greater than the sum of the radii, then the candidate autodetector is considered not to be covered by any mature autodetector, and it is added to the mature autodetector set. If the distance between the candidate autodetector and any mature autodetector is less than the difference of their radii, then the candidate autodetector is considered to be completely covered by mature autodetectors, and it is discarded. If neither of the above two conditions is met, then the candidate autodetector is considered to be partially covered by mature autodetectors. The Monte Carlo random point estimation algorithm is used to calculate the specific coverage maturity and determine whether to retain it.

[0113] Please see Figure 7 and Figure 8 , Figure 7 This is a flowchart of the maturity tolerance process of a candidate self-detector based on the Monte Carlo algorithm provided in an embodiment of the present invention. Figure 8 This is a schematic diagram showing the coverage and radius relationship between candidate self-detectors and mature self-detectors provided in an embodiment of the present invention, wherein part (a) represents absolute coverage, part (b) represents partial coverage, and part (c) represents no coverage.

[0114] The main purpose of maturity tolerance is to reduce redundancy in the mature self-detector set during the process of adding candidate self-detectors. Specifically, firstly, the radii of the current candidate self-detectors are sorted according to a decreasing rule, and the first candidate self-detector after sorting (i.e., the detector with the largest radius) is directly added to the mature self-detector set. Initially, the mature self-detector set only contains this candidate self-detector with the largest radius. Subsequently, as other candidate self-detectors mature and are added, the mature self-detector set continuously expands. Next, subsequent candidate self-detectors are taken out sequentially, and using the detector's radius, a rough relationship between the current candidate self-detector and any mature self-detector is determined: if a distance exists from the current candidate self-detector to any mature self-detector... Less than or equal to the difference between the radius of the mature self-detector and the radius of the candidate self-detector. , as follows Figure 8 As shown in part (a), if the candidate autodetector falls entirely within the range of mature autodetectors, it should be deleted. If the distance from the current candidate autodetector to all mature autodetectors is greater than or equal to the sum of the radius of the mature autodetectors and the radius of the candidate autodetector, then... ,as follows Figure 8 As shown in section (c), it is considered that the candidate self-detector is not covered by the mature self-detector at all and should be retained.

[0115] If a candidate autodetector does not meet either of the above two conditions, it is considered that the candidate autodetector is partially covered by mature autodetectors. We further calculate the degree of coverage. and All mature autodetectors are selected, and these specific mature autodetectors overlap with the candidate autodetector. Then, Monte Carlo methods are used to randomly generate autodetectors within the candidate autodetector pool. Given a sample, find the number of samples that simultaneously fall into both the mature self-detector and the candidate self-detector categories. The repetition coverage of this candidate self-detector can be calculated as follows:

[0116]

[0117] When the repetition coverage of the candidate autodetector Greater than our set threshold If a candidate self-detector fails to develop, it is removed, and the next candidate self-detector is selected for tolerance testing. This process continues until all detectors have completed tolerance testing, at which point the algorithm terminates. The conditions for a candidate self-detector to evolve into a mature self-detector are as follows:

[0118]

[0119] In one implementation, step S5 includes:

[0120] Using the mature self-detector set generated in step S4, calculate the Euclidean distance between the mature self-detector set and the unknown antigen, which is used as the affinity between the mature antibody and the unknown antigen. If the distance from the unknown antigen to a certain mature self-detector is less than the radius of the mature self-detector, that is, the unknown antigen is recognized by a certain mature antibody, then the antigen is considered to be an autoantigen. If the unknown antigen is not recognized by any mature antibody, then it is classified as a non-autoantigen.

[0121] Example 2

[0122] Based on the same inventive concept, this embodiment discloses a compressed network traffic anomaly detection system based on the dynamic evolution of an immune detector, comprising:

[0123] The general compressed traffic identification module is used to identify the specific compression algorithm used in compressed traffic by utilizing the header field of compressed data packets, decompress the compressed data packets using the identified compression algorithm, and extract the network traffic characteristics therein.

[0124] The feature selection module is used to measure the importance of extracted network traffic features from multiple perspectives using a hybrid filtering embedded feature selection technology. It further uses a weighted voting method to integrate the importance of the features measured from multiple perspectives, and finally uses a recursive feature accumulation strategy to select the optimal feature subset.

[0125] The candidate self-detector generation and evolutionary tolerance module is used to perform hierarchical clustering on the antigen training set based on the optimal feature subset sample space obtained by the feature selection module, and construct an antigen clustering feature tree. It generates candidate self-detectors using autoantigens and completes the evolutionary tolerance of candidate self-detectors with non-autoantigens based on the antigen clustering feature tree. The nodes in the antigen clustering feature tree are represented by the format of a quadruple <linear sum of antigen positions, square sum of antigen positions, set of autoantigen indexes, set of non-antigen indexes>. Antigens include autoantigens and non-autoantigens. Autoantigens represent normal network activity, and non-autoantigens represent abnormal or illegal network activity.

[0126] The candidate self-detector maturation tolerance module is used to further complete the maturation tolerance of candidate self-detectors based on the position and radius relationship between candidate self-detectors and the mature self-detector set, and add the retained candidate self-detectors to the mature self-detector set.

[0127] The mature self-detector anomaly detection module is used to calculate the affinity between the mature self-detectors in the mature self-detector set and the unknown antigens in the test set. If the unknown antigen can be recognized by the mature self-detectors, it is considered to be an autoantigen; if it cannot be recognized, it is considered to be a non-autoantigen.

[0128] The general compressed traffic identification module introduces compressed packet header extraction and identification technology; the feature selection module introduces filtering and wrapping feature selection algorithms; the candidate self-detector generation and evolution tolerance module introduces antigen hierarchical clustering algorithm; the candidate self-detector maturity tolerance module introduces Monte Carlo-based collaborative coverage evaluation algorithm for multiple mature self-detectors; and the mature self-detector anomaly detection module uses mature detectors to detect anomalies in network traffic.

[0129] Specifically, (1) A general compression algorithm identification module based on compressed data packet header matching quickly identifies the compression algorithm used by the compressed packet using the packet header information. (2) A feature selection module based on hybrid filtering and wrapping uses feature selection algorithms with different strategies to calculate the feature importance of network traffic features from multiple perspectives. Then, a weighted voting-based aggregation strategy is used to synthesize the above feature importance. Finally, a recursive accumulation method is used to find the optimal feature subset. (3) A candidate self-detector generation and evolution tolerance module based on antigen clustering first performs hierarchical clustering of antigens and constructs an antigen clustering feature tree. Then, using the self-antigens in the leaf nodes of the antigen clustering feature tree, candidate self-detectors are directly generated. Finally, by using the characteristic of the antigen clustering feature tree as a B+ fast index, the feature non-self-antigens that are evolutionarily tolerant to the candidate self-detectors are quickly locked, realizing fast and accurate evolution tolerance of candidate self-detectors. (4) A candidate self-detector maturity tolerance module based on Monte Carlo first uses the relationship between the radius of the candidate self-detector and the mature self-detector and the distance between them to initially determine whether the candidate self-detector is covered. Next, candidate self-detectors partially covered by mature self-detectors are selected, and the coverage degree is further determined by the Monte Carlo algorithm. Finally, based on the different coverage degrees, it is determined whether to add the candidate self-detectors to the set of mature self-detectors. (5) Using the anomaly detection module of the mature self-detectors, based on the compressed network traffic identification method proposed above and the mature self-detectors generated above, compressed network traffic is detected to identify abnormal behaviors in network activities.

[0130] In one implementation, the candidate self-detector generation module is specifically used for:

[0131] The optimal feature subset obtained by the feature selection module is used to perform hierarchical clustering on the antigen training set, and the antigen clustering feature tree is gradually constructed based on the clustering results.

[0132] Candidate self-detectors are directly generated by using the self-antigens in the leaf nodes of the antigen clustering feature tree;

[0133] By leveraging the fast indexing properties of antigen clustering feature trees, specific non-self sets that are tolerant to the current candidate autodetector are identified.

[0134] Evolutionary tolerance of candidate self-detectors is achieved by calculating the affinity between candidate self-detectors and specific non-self sets.

[0135] Since the system described in Embodiment 2 of this invention is the same system used to implement the compressed network traffic anomaly detection method based on dynamic evolution of the immune detector in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0136] Example 3

[0137] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in Embodiment 1.

[0138] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the compressed network traffic anomaly detection method based on dynamic evolution of the immune detector in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0139] Example 4

[0140] Based on the same inventive concept, this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method in Embodiment 1.

[0141] Since the computer device described in Embodiment 4 of this invention is the same computer device used to implement the compressed network traffic anomaly detection method based on dynamic evolution of immune detectors in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0142] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0143] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0144] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A method for network traffic anomaly detection based on dynamic evolution of immune detector, characterized in that, Comprise: S1: using the compressed data packet header field to identify the compression algorithm used by the compressed traffic, using the identified compression algorithm to decompress the compressed data packet, and extracting the network traffic features therein; S2: using a hybrid filtering embedded feature selection technology to measure the importance of the extracted network traffic features from multiple angles, and further using a weighted voting method to integrate the feature importance of the above multiple angle measurements, and finally using a recursive feature accumulation strategy to select the optimal feature subset; S3: Based on the optimal feature subset sample space obtained in step S2, the antigen training set is hierarchically clustered, and an antigen clustering feature tree is constructed; candidate self-detectors are generated using autologous antigens, and the evolution of candidate self-detectors with non-autologous antigens is completed based on the antigen clustering feature tree, wherein the node in the antigen clustering feature tree is represented in the format of four-tuple <antigen position linear sum, antigen position square sum, autologous antigen index set, non-autologous antigen index set>, and the antigen includes autologous antigen and non-autologous antigen, the autologous antigen represents normal network activity, and the non-autologous antigen represents abnormal or illegal network activity; S4: According to the position and radius relationship between the candidate self-detector and the mature self-detector set, the maturation of the candidate self-detector is further completed, and the remaining candidate self-detector is added to the mature self-detector set; S5: Using the mature self-detector in the mature self-detector set to calculate the affinity with the unknown antigen in the test set, if the unknown antigen can be recognized by the mature self-detector, it is considered that the antigen is autologous, if it cannot be recognized, it is considered that the antigen is non-autologous.

2. The dynamic evolution of immune detector based compression network traffic anomaly detection method of claim 1, wherein, In step S1, the header field of the compressed data packet is used to identify the compression algorithm used by the compressed traffic, comprising: Using ID1 ID2 CM header to identify gzip compression algorithm, wherein ID1 is a fixed value of 0x1f, ID2 is a fixed value of 0x8b, CM represents compression algorithm, and CM is 8 indicating that deflate algorithm is used; Using CMF FLG header to identify zlib compression algorithm, wherein CMF is 0x78 indicating that deflate algorithm is used, and FLG is 0x9c indicating that the maximum compression level is used; Using the character 'BZ' to identify the network traffic compressed by bzip2; Using the header of xz compression algorithm to identify the network traffic compressed by xz; Using the character 'Rar' to identify the network traffic compressed by rar.

3. The dynamic evolution of immune detector based compression network traffic anomaly detection method of claim 1, wherein, Step S2 includes: Using feature selection techniques based on coefficient of variation, Pearson correlation coefficient, random forest and gradient boosting decision tree algorithm to measure the importance of features from the divergence of features, the correlation between features and labels, and the correlation between features; Using a weighted voting strategy to give different weights to the above feature selection techniques, and further calculating the final importance of each feature; Using a recursive feature accumulation strategy to calculate the optimal feature subset under the condition of the highest network anomaly detection rate.

4. The dynamic evolution of immune detector based compression network traffic anomaly detection method of claim 1, wherein, Step S3 includes: Using the optimal feature subset obtained in step S2 to hierarchically cluster the antigen training set, and gradually constructing an antigen clustering feature tree according to the clustering results; Directly generate a candidate self-detector by using the autoantigens in the leaf nodes of the antigen clustering feature tree; Find out a specific non-self set that is tolerant to the current candidate self-detector by using the fast indexing property of the antigen clustering feature tree; Complete the evolutionary tolerance of the candidate self-detector by calculating the affinity between the candidate self-detector and the specific non-self set.

5. The dynamic evolution of immune detector based compression network traffic anomaly detection method of claim 1, wherein, Step S4 comprises: Calculate the distance between the candidate self-detector and the mature self-detector, obtain the radius of the candidate self-detector and the mature self-detector, if the distance between the candidate detector and all mature self-detectors is greater than the sum of the radius of the candidate detector and the mature self-detector, it is considered that the candidate self-detector is not covered by any mature self-detector, and it is added to the mature self-detector set; if the distance between the candidate detector and any mature self-detector is less than the difference between the radius of the candidate detector and the mature self-detector, it is considered that the candidate self-detector is completely covered by the mature self-detector, and it is discarded; if the above two conditions are not met, it is considered that the candidate detector is partially covered by the mature self-detector, and the Monte Carlo random point estimation algorithm is used to calculate the specific coverage mature, and it is judged whether to retain.

6. The dynamic evolution of immune detector based compression network traffic anomaly detection method of claim 1, wherein, Step S5 comprises: Using the mature self-detector set generated in step S4, calculate the Euclidean distance between the mature self-detector set and the unknown antigen as the affinity between the mature antibody and the unknown antigen, if the distance from the unknown antigen to a certain mature self-detector is less than the radius of the mature self-detector, that is, the unknown antigen is recognized by a certain mature antibody, it is considered that the antigen is an autoantigen, if the unknown antigen is not recognized by any mature antibody, it is classified as a non-self antigen.

7. A compressed network traffic anomaly detection system based on dynamic evolution of immune detectors, characterized in that, Comprise: A general compressed traffic identification module is used to identify the specific compression algorithm used by the compressed traffic by using the packet header field of the compressed packet, decompress the compressed packet by using the identified compression algorithm, and extract the network traffic features therein; A feature selection module is used to adopt a hybrid filtering embedded feature selection technology to multi-angle measure the importance of the extracted network traffic features, further adopt a weighted voting method to comprehensively measure the feature importance of the above multi-angle measurement, and finally adopt a recursive feature accumulation strategy to select an optimal feature subset; A candidate self-detector generation and evolutionary tolerance module is used to perform hierarchical clustering on an antigen training set on the basis of an optimal feature subset sample space obtained by the feature selection module, and construct an antigen clustering feature tree; candidate self-detectors are generated by using autoantigens, and evolutionary tolerance of the candidate self-detectors to non-self antigens is completed based on the antigen clustering feature tree, wherein a node in the antigen clustering feature tree is represented in the format of a quadruple <antigen position linear sum, antigen position square sum, autoantigen index set, non-self antigen index set>, the antigens include autoantigens and non-self antigens, the autoantigens represent normal network activities, and the non-self antigens represent abnormal or illegal network activities; A candidate self-detector maturation tolerance module is used to further complete the maturation tolerance of the candidate self-detector according to the position and radius relationship between the candidate self-detector and the mature self-detector set, and add the retained candidate self-detector to the mature self-detector set. The mature self-detector anomaly detection module is configured to perform affinity calculation between a mature self-detector in the mature self-detector set and an unknown antigen in the test set, and if the unknown antigen can be recognized by the mature self-detector, the antigen is considered as a self antigen, and if the unknown antigen cannot be recognized by the mature self-detector, the antigen is considered as a non-self antigen.

8. The dynamic evolution of immune detector based compressed network traffic anomaly detection system of claim 7, wherein, The candidate self-detector generation and evolution tolerance module is specifically configured to: perform hierarchical clustering on the antigen training set by using the optimal feature subset obtained by the feature selection module, and gradually construct an antigen clustering feature tree according to the clustering result; generate a candidate self-detector directly by using the self antigens in the leaf nodes of the antigen clustering feature tree; find a specific non-self antigen set that is tolerant to the current candidate self-detector by using the fast indexing property of the antigen clustering feature tree; evolve the tolerance of the candidate self-detector by calculating the affinity between the candidate self-detector and the specific non-self antigen set.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program, when executed, implements the method of any one of claims 1 to 6.

10. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1 to 6 when executing the program.

Images