Computer virus detection method and system based on improved clone selection algorithm

Abstract

The invention belongs to the technical field of virus detection, and discloses a virus detection method based on an improved clone selection algorithm, the population diversity is enhanced, a Halton sequence is introduced for population initialization, the problem of uneven distribution caused by a traditional random initialization method is solved, the uniformly distributed population is beneficial to more comprehensive exploration of a solution space, and the detection efficiency is improved. And the population diversity is enhanced. By balancing the fitness and the distance, the antibody population is prevented from being gathered in a local optimal area too early, the population diversity is effectively increased, the search process is pushed to approach a global optimal solution, and therefore the risk of falling into local optimum is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer virus detection, and in particular relates to a computer virus detection method and system based on an improved clone selection algorithm. Background Art

[0002] With the development of network information technology, the Internet has been deeply integrated into people's daily lives. In the context of "Internet +" and "5G era", computer viruses are becoming more intelligent, high-frequency, highly aggressive and anti-detectable, and the network security situation is becoming increasingly severe.

[0003] How to effectively prevent virus invasion has become an important issue that needs to be solved in the field of computer virus detection. As a branch of machine learning, artificial immune algorithm draws on the principle of self-identification antigen in biological immunology and has strong adaptability, learning ability and pattern recognition ability. Since computer viruses have certain life characteristics and algorithmic characteristics, the application of artificial immune algorithm in virus detection has great potential. Studies have shown that artificial immune algorithm has significant advantages in optimizing the feature selection of virus detection system, and can improve the system's adaptability and sensitivity to abnormal behavior. By adopting artificial immune algorithm, virus detection system can more efficiently and accurately identify and defend against complex computer viruses, thereby further improving the level of network security.

[0004] Computer virus detection technology usually relies on virus features, computer operating status, and abnormal behavior in network traffic to identify network viruses. Static detection technology is the most traditional and commonly used method. It is usually scanned by comparing virus feature libraries. The feature library is built based on the feature codes of known viruses. However, this method has a lag problem. If the virus feature library is not updated in time, it will not be able to identify newly emerged virus variants. Since feature matching relies on comparing known feature codes one by one, once the virus program changes, the effectiveness of the feature code will decrease, making it impossible to identify the variant virus. Therefore, it is particularly important to choose the right virus feature.

[0005] Through the above analysis, the problems and defects of the prior art are as follows:

[0006] (1) Static detection technology based on feature scanning: Unable to detect unknown viruses or mutant viruses.

[0007] (2) Dynamic detection technology based on behavioral analysis: high false alarm rate, high resource consumption, and unable to cope with virus hiding technology.

[0008] (3) Detection technology based on virtual machines: The model is complex, the false alarm rate is high, and the dependence is strong.

[0009] (4) Hybrid static and dynamic detection technology: The model is complex, the training time is long, and it is difficult to be widely used. Summary of the invention

[0010] In view of the problems existing in the prior art, the present invention provides a computer virus detection method based on an improved clone selection algorithm.

[0011] The present invention is implemented in this way: a computer virus detection method based on an improved clone selection algorithm comprises:

[0012] Step 1, use Halton sequence to initialize antibody population and related parameter settings;

[0013] Step 2, calculating the fitness value of each antibody;

[0014] Step 3, using the fitness-distance balance strategy to select the antibody population;

[0015] Step 4, cloning the selected antibody;

[0016] Step 5, mutating the cloned antibody;

[0017] In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation;

[0018] Step 6, update operation;

[0019] Select the n antibodies with the highest contribution from the mutated antibody set as the new excellent antibody set, and then randomly add Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation;

[0020] Step 7, iteration;

[0021] Repeat step 2 until the maximum number of iterations G is reached. max ;

[0022] Step 8, output the optimal feature combination;

[0023] After the training of the above steps is completed, the optimal feature combination is output to build a virus feature library;

[0024] Step 9, virus detection.

[0025] Furthermore, the Halton sequence is used to initialize the antibody population and set related parameters:

[0026] The feature code is extracted using the N-Gram algorithm to convert the features in the program into a set of hexadecimal bytes; the specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form the feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, and parameters such as the mutation rate, the scale of excellent antibodies, and the crossover rate are set.

[0027] Further, the fitness value of each antibody is calculated:

[0028] The specific fitness value (maliciousness) calculation method is as follows:

[0029]

[0030] where F i is the maliciousness level, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0031] Furthermore, the fitness-distance balance strategy is used to select the antibody population:

[0032] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance from the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0033] Next, the contribution of the antibody is calculated using formula (10): This formula combines the fitness value of the antibody and the distance to the optimal antibody; antibodies with higher contribution are selected for cloning operations;

[0034]

[0035]

[0036] in is the contribution of antibodies, is the normalized distance value, P irepresents the ith antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0037] Further, the selected antibodies are cloned:

[0038] The number of antibody clones satisfies the following formula:

[0039]

[0040] Where a and b are both constants, and a>0, and max_clone is the maximum number of clones.

[0041] Further, the virus detection:

[0042] The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0043]

[0044] M={m1,m2,..,m x}Formula (13)

[0045] T={t1,t2,..,t y}Formula (14).

[0046] Another object of the present invention is to provide a computer virus detection system based on an improved clone selection algorithm, comprising:

[0047] Initialization module, used to initialize antibody population and related parameter settings;

[0048] A calculation module, used to calculate the contribution value of each antibody;

[0049] Selection module, used for selection operation;

[0050] A cloning module, used to clone the selected antibodies;

[0051] The mutation module is used to mutate the cloned antibodies. In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation.

[0052] The update module is used for update operations; the n antibodies with the highest contribution are selected from the mutated antibody set as the new excellent antibody set, and then Nn antibodies are randomly added to the antibody set, and the population P' is used as the initial population of the next generation;

[0053] Iteration module, used for iteration; until the maximum number of iterations G is reached max;

[0054] Output module, used to output the optimal feature combination;

[0055] Virus detection module, used for virus detection.

[0056] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the virus detection method based on the improved clone selection algorithm.

[0057] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the virus detection method based on the improved clone selection algorithm.

[0058] Another object of the present invention is to provide an information data processing terminal, which is used to implement the virus detection system based on the improved clone selection algorithm.

[0059] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0060] First, the present invention aims to solve the problem that the traditional feature scanning static detection technology cannot detect unknown viruses or mutant viruses, and applies the clone selection algorithm to the feature selection problem in computer virus detection. As a kind of artificial immune algorithm, the clone selection algorithm simulates the proliferation, differentiation and mutation mechanism of immune cells, clones and mutates high-affinity antibodies, and updates low-affinity antibodies at the same time, thereby enhancing the recognition ability of unknown antigens. Although the clone selection algorithm has the characteristics of novel structure, it still has problems such as insufficient population diversity and easy to fall into local optimality. For this reason, the present invention improves the clone selection algorithm.

[0061] The present invention proposes a feature selection method based on an improved clone selection algorithm and applies it to computer virus detection. The original clone selection algorithm relies on random numbers in the population initialization stage. This randomization method cannot ensure the uniform distribution of individuals in the search space, resulting in the population possibly missing part of the search space, thereby affecting the convergence accuracy and population diversity. In the selection stage, the traditional algorithm adopts a greedy strategy and simply relies on the fitness value to select antibodies. Antibodies with higher fitness are preferentially selected for cloning and mutation operations, while antibodies with lower fitness are ignored. This method ignores the distance between antibodies, which easily causes the antibody population to gather in a local area, thus falling into a local optimal solution.

[0062] To solve the above problems, the present invention proposes an improved clonal selection algorithm and applies it to the feature code selection in computer virus detection. The improved method first uses the Halton sequence to initialize the population to ensure that the population is evenly distributed in the solution space, thereby increasing the diversity of the population and improving the convergence accuracy of the algorithm. Secondly, the fitness-distance balance strategy is adopted to select antibodies. Unlike traditional methods, the new strategy is not only based on the fitness value of the antibody, but also considers its distance from the current optimal antibody, comprehensively evaluates the fitness and distance, and measures the contribution of the antibody more comprehensively. In this way, the algorithm can more comprehensively consider the impact of antibodies on the population when selecting them, thereby guiding the population to evolve in a more potential direction, maintain diversity, and avoid premature convergence.

[0063] The present invention introduces the Halton sequence and fitness-distance balance strategy, and balances the relationship between fitness and distance through the balance factor δ, thereby selecting more differentiated antibodies, increasing population diversity, and reducing the risk of falling into local optimality. Experimental results show that the method proposed by the present invention effectively solves the shortcomings of the original clone selection algorithm in virus feature selection.

[0064] Inspired by the Halton sequence and the fitness-distance balance strategy, the present invention proposes a clonal selection algorithm based on the fitness-distance balance strategy, aiming to solve the feature selection problem in virus detection. By using the Halton sequence, the individual distribution problem during random initialization is improved, making the population more uniform and increasing the diversity of the population. At the same time, the fitness-distance balance strategy is adopted to effectively reduce the risk of premature convergence, thereby improving the convergence accuracy of the algorithm.

[0065] Compared with the traditional clone selection algorithm, the present invention has the following advantages:

[0066] (1) Enhanced population diversity: The Halton sequence is introduced for population initialization, which overcomes the uneven distribution problem caused by the traditional random initialization method. The uniformly distributed population helps to explore the solution space more comprehensively, thus enhancing population diversity.

[0067] (2) Improving convergence accuracy and reducing the risk of local optimality: By balancing fitness and distance, the present invention avoids the antibody population from gathering in the local optimal area too early, effectively increases the population diversity, and promotes the search process to move closer to the global optimal solution, thereby reducing the risk of falling into the local optimal solution.

[0068] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0069] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0070] 1. Enhance market competitiveness: With the increasing demand for efficient virus detection technology in the field of network security, especially in emerging fields such as the Internet of Things, cloud computing, and smart devices, the demand for virus detection systems continues to grow. The present invention provides an innovative virus detection method with strong market competitiveness and can occupy a place in the global network security market. Through technology licensing, technology transfer, cooperative development, etc., the commercial application of the present invention can bring considerable income to the enterprise and promote its position and brand influence in the network security industry.

[0071] 2. Drive innovation and development of the network security industry chain: The present invention is not only a technological innovation, but also has a far-reaching impact on the entire network security industry chain. Through cooperation with antivirus software manufacturers, enterprise network security service providers, government agencies, etc., the present invention can promote the technological progress of the entire industry chain. For example, antivirus software manufacturers can integrate the technology of the present invention into existing products to enhance their market competitiveness; at the same time, the technological innovation of the present invention can also promote the exploration of new business models, such as the launch of new security services such as intelligent virus protection systems based on artificial immune algorithms and cloud virus monitoring platforms.

[0072] (2) The technical solution of the present invention fills the technical gap in the industry at home and abroad:

[0073] 1. Application of improved clone selection algorithm: Traditional clone selection algorithms generally face problems such as uneven population initialization and premature convergence in virus feature selection. These problems seriously affect the global search capability and convergence accuracy of the algorithm. Although some studies have attempted to improve algorithm performance by improving initialization strategies or adjusting selection mechanisms, these technical bottlenecks have not been effectively resolved. The present invention introduces a fitness-distance balance strategy to guide the evolutionary direction of the population, avoid the concentration of the population in a local area, and fundamentally improve the global search capability of the algorithm.

[0074] 2. Technological breakthrough of virus detection system: Existing virus detection systems mainly rely on feature library matching and static scanning, and cannot cope with the problem of new virus variants. Especially in the face of large-scale and complex network attacks, existing systems often have a high rate of missed detection. By introducing an improved clone selection algorithm, the present invention provides a new idea for virus detection technology, filling the gap that existing technologies cannot efficiently handle new viruses and malware.

[0075] (3) The technical solution of the present invention solves the technical problems that people have been eager to solve but have never been able to solve successfully:

[0076] 1. Detection of new virus variants: The continuous mutation of computer viruses and the rapid emergence of new viruses are one of the biggest challenges facing virus detection technology. Traditional static virus detection methods rely on known virus feature libraries. However, with the rapid evolution of virus variants, the update of feature libraries lags behind, making it difficult for new viruses to be detected in a timely manner. The present invention introduces an improved clone selection algorithm that can dynamically learn and select the most relevant virus features in real time, greatly improving the system's adaptive ability and accuracy in identifying new viruses, thereby effectively solving the problem of new virus variants not being able to be detected in a timely manner.

[0077] 2. Algorithm optimization problem: The traditional clone selection algorithm is prone to fall into the local optimal solution during the feature selection process, which affects the convergence accuracy and performance of the algorithm. Many researchers have tried various optimization methods, but most methods have not completely solved this problem. By introducing Halton sequence initialization and fitness-distance balance strategy, the present invention provides an effective solution, which greatly improves the efficiency and accuracy of feature selection, avoids the trouble of local optimal solution, and promotes the overall progress of virus detection technology.

[0078] (4) The technical solution of the present invention overcomes technical prejudice:

[0079] 1. Overcoming the bias of local optimal solution: Traditional clone selection algorithms often rely on fitness values ​​to select antibodies, which easily leads to the aggregation of populations in a certain local area, and then falls into the dilemma of local optimal solution. Although many improved methods have proposed strategies to enhance diversity and avoid premature convergence, most of them still fail to completely break through this bottleneck. By introducing the fitness-distance balance strategy, the present invention effectively avoids this bias and promotes the realization of global search.

[0080] 2. Overcoming the bias of random initialization: Traditional clonal selection algorithms usually use random numbers to initialize the population, which may lead to uneven distribution of individuals in the search space, affecting the search efficiency. Although some improved algorithms have tried to use other initialization methods, most of them have failed to completely solve this problem. The present invention uses the Halton sequence to ensure the uniform distribution of the population in the solution space, overcomes the bias of the traditional random initialization method, and greatly improves the search capability.

[0081] Third, in the feature selection process, traditional computer virus detection technology often relies on manual experience or simple statistical methods, which is difficult to cope with diversified and complex virus feature data. This method is not only time-consuming, but may also miss important features, resulting in insufficient computer virus detection results. The present invention improves the clone selection algorithm to quickly screen out the most representative feature combinations from massive virus feature code data, significantly reduce feature dimensions, and eliminate redundant and useless features, significantly improving the efficiency and quality of feature selection.

[0082] In the prior art, computer virus detection models often face problems such as insufficient accuracy and high false alarm rate when processing complex data, making them difficult to cope with complex and changing application scenarios. The present invention adopts an improved clone selection algorithm to select virus features, which significantly improves the detection accuracy and stability of the model, ensuring that it is suitable for a variety of computer virus detection tasks.

[0083] The present invention realizes the improvement of the whole process from feature selection to model optimization in computer virus detection technology, and solves the efficiency bottleneck and performance limitation of traditional methods. Through multiple rounds of iterative optimization, the optimal feature combination finally output has higher detection accuracy and robustness. This technology has important industrial value in scenarios such as network security protection, information system protection, and anti-new computer virus research, and provides efficient and reliable technical support for data center protection, enterprise network security, and software supply chain security.

[0084] Fourth, existing technical problems:

[0085] Traditional computer virus detection methods mainly rely on virus signature library matching or rule-based static analysis technology, which has the following main problems:

[0086] 1) Unable to quickly adapt to new viruses: The rapid generation of new and variant viruses makes it difficult to update static analysis based on feature libraries in a timely manner, resulting in a decrease in detection rate.

[0087] 2) High false alarm rate: The ability to distinguish the characteristics of normal programs and virus programs is limited, which easily leads to high false alarm and missed alarm rates.

[0088] 3) Inefficiency: Traditional methods require scanning a large number of program features or samples one by one, which is time-consuming and cannot meet the needs of real-time detection.

[0089] 4) Insufficient dynamic behavior analysis: Unable to effectively capture the dynamic behavior characteristics of the virus during operation.

[0090] Improvements of the algorithm and mathematical model of the present invention:

[0091] 1) Dynamically initialize the antibody population:

[0092] By using the Halton sequence to generate an initial antibody population with global distribution and combining it with the N-Gram algorithm to extract program features, a more efficient representation of viral features can be achieved. Compared with traditional random initialization methods, the Halton sequence provides a more uniform population distribution, ensuring that the algorithm covers a wider search space in the initial stage.

[0093] 2) Calculation of maliciousness:

[0094] The maliciousness model is used to combine the feature statistics of virus programs and normal programs to quantify the importance and distribution characteristics of the features. By calculating the probability and frequency distribution of the features in viruses and normal programs, formulas (7) and (8) ensure that the calculation of the maliciousness has a stronger ability to distinguish.

[0095] 3) Fitness-distance balance strategy:

[0096] In the process of antibody selection, the similarity between antibodies is calculated by formula (9), and the normalized fitness value and normalized distance value of formula (10) are combined to balance the contribution and diversity of antibodies. This strategy effectively avoids the algorithm from falling into local optimality and enhances the diversity and global search capability of the antibody population.

[0097] 4) Cloning and optimization:

[0098] Formula (11) is used to dynamically allocate the number of antibody clones and adjust the clone ratio according to the contribution of the antibody. Dynamic mutation operations are used to enhance the antibody exploration capability and ensure that the coverage of the optimized antibody is more consistent with the feature library.

[0099] 5) Cosine similarity virus detection:

[0100] In the virus detection stage, the similarity between the features of the program to be detected and the virus feature library is calculated by formula (12), and the cosine distance is used to quantify the matching degree, thereby improving the accuracy of detection.

[0101] Significant technological advancements:

[0102] 1) Improve virus detection efficiency:

[0103] The dynamically initialized and optimized clone selection algorithm significantly reduces the search time and computing resource consumption in the virus detection process, especially showing higher efficiency in large-scale sample analysis.

[0104] 2) Detection accuracy is significantly improved:

[0105] The antibody selection strategy based on fitness-distance balance and the cosine similarity calculation model can more accurately distinguish virus characteristics from normal characteristics and reduce false alarm and missed alarm rates.

[0106] 3) Enhance the ability to detect unknown viruses:

[0107] Through dynamic learning of features and optimization, the present invention can effectively identify new viruses and variants not included in the feature library, thereby improving the detection capability of unknown threats.

[0108] 4) Wide applicability and scalability:

[0109] The present invention is not only applicable to conventional static analysis scenarios, but can also be extended to multiple fields such as dynamic behavior analysis and network threat detection, and has great application potential and commercial value. BRIEF DESCRIPTION OF THE DRAWINGS

[0110] Figure 1 It is a flow chart of a virus detection method based on an improved clone selection algorithm provided in an embodiment of the present invention.

[0111] Figure 2 It is a structural block diagram of a virus detection system based on an improved clone selection algorithm provided by an embodiment of the present invention.

[0112] Figure 3 It is a detailed flow chart of virus detection based on the improved clone selection algorithm provided by an embodiment of the present invention.

[0113] Figure 4 4 is a detection rate diagram of three algorithms provided in the embodiments of the present invention.

[0114] Figure 5 This is a picture of the virus quantity statistics page.

[0115] Figure 6 This is the virus detection page picture.

[0116] Figure 7 This is the interface showing the virus detection scan results.

[0117] Figure 8 This is the log report page diagram.

[0118] Fig. 9 This is the virus database upgrade page.

[0119] Fig.10 This is the virus database sharing page diagram.

[0120] Fig.11 This is the picture of the virus database management page.

[0121] Fig.12 It is a scatter plot of the Henchiri data set comparison experiment.

[0122] Fig.13 This is the scatter plot of Experiment 1.

[0123] Fig.14 This is the scatter plot of Experiment 2.

[0124] Fig.15 This is the scatter plot of Experiment 3. DETAILED DESCRIPTION

[0125] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0126] The following are two specific application examples of the computer virus detection system based on the improved clone selection algorithm:

[0127] 1. Optimization of cloud storage file virus detection features

[0128] Application scenario: In cloud storage services, files uploaded by users may contain hidden computer viruses, which may spread on a large scale through file sharing functions. Due to the diversity of file types and complex virus characteristics, accurately extracting the detection characteristics of virus files becomes the key.

[0129] System application: Use the system initialization file features (such as file hash values, specific code snippets, executable behaviors, etc.) of the present invention as antibody populations, and evaluate the accuracy and false positive rate of virus file detection by each feature through antibody fitness values. Through multiple rounds of feature selection, cloning, mutation, and optimization iterations, the system finally outputs the feature combination with the highest fitness value, which is used to build a cloud storage computer virus detection model to improve the detection efficiency of virus files.

[0130] Practical significance: The optimized file feature combination can quickly locate virus files in cloud storage, avoid virus propagation, improve the security of cloud storage platforms, and provide reliable protection for user data.

[0131] 2. Malware detection in enterprise network security environments

[0132] Application scenario: In enterprise networks, malware with viruses poses a serious threat to business security. Due to the diversity and variability of malware, traditional signature-based detection methods are difficult to respond to complex threats in a timely manner. It is necessary to extract key features from massive network traffic and terminal data for real-time analysis.

[0133] System application: The system receives network traffic logs, terminal file behavior records and threat intelligence data, and initializes the typical features of malware (such as behavior patterns, communication protocols, and code snippets) into feature populations. Through optimization by the clonal selection algorithm, the system extracts the most discriminating feature combination and marks potential threat files or activities in real time.

[0134] Practical significance: The optimized computer virus detection model can significantly improve the detection accuracy and response speed of malware, help enterprises discover and prevent the spread of malware in the early stages, and protect critical data and systems from damage.

[0135] These two embodiments demonstrate the system's potential for wide application in cloud storage security and enterprise network security. They both embody efficient and accurate computer virus detection and protection capabilities, and provide strong security protection for cloud platforms and enterprise network environments.

[0136] like Figure 1 As shown, a computer virus detection method based on an improved clone selection algorithm provided by an embodiment of the present invention comprises the following steps:

[0137] S101, using Halton sequence to initialize antibody population and related parameter settings;

[0138] S102, calculating the fitness value of each antibody;

[0139] S103, using the fitness-distance balance strategy to select the antibody population;

[0140] S104, cloning the selected antibodies;

[0141] S105, mutating the cloned antibody;

[0142] In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation;

[0143] S106, update operation;

[0144] Select the n antibodies with the highest contribution from the mutated antibody set as the new excellent antibody set, and then randomly add Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation;

[0145] S107, iteration;

[0146] Repeat S102 until the maximum number of iterations G is reached. max ;

[0147] S108, outputting the optimal feature combination;

[0148] After the training of the above steps is completed, the optimal feature combination is output to build a virus feature library;

[0149] S109, virus detection.

[0150] In step S101, the Halton sequence is first used to initialize the antibody population, which consists of multiple antibody individuals. Relevant parameters are set, including population size, number of clones, mutation probability, and termination conditions. Through reasonable parameter settings, the population diversity and algorithm stability are ensured, providing a basis for subsequent optimization.

[0151] In step S102, the fitness value of each antibody is calculated based on the virus detection sample data. The fitness value reflects the effect of the antibody in identifying the virus sample, which is usually measured by the degree of maliciousness. Through the calculation of the fitness value, the antibodies with better performance in the current population are identified, providing a basis for subsequent selection operations.

[0152] In step S103, antibodies are selected according to the fitness-distance balance strategy, and antibodies with higher contribution values ​​are preferentially selected to enter the next round of cloning. The selection mechanism adopts the fitness-distance balance strategy to maintain the diversity of the population and prevent premature convergence.

[0153] In step S104, the selected antibodies are cloned. The number of clones is proportional to the contribution value of the antibody. The antibodies with higher contribution values ​​will generate more clones. The purpose of the cloning operation is to increase the proportion of excellent antibodies in the population and lay the foundation for the next step of variation optimization.

[0154] In step S105, the clones are mutated to introduce population diversity. The probability of mutation is inversely proportional to the affinity (contribution value) of the antibody. The higher the contribution value of the antibody, the smaller the probability of mutation and the smaller the amplitude of mutation, thereby protecting the excellent characteristics; while the antibody with a lower contribution value has a higher probability of mutation to explore new solution space. Mutation can be achieved by fine-tuning or randomly perturbing the feature vector, aiming to further optimize the virus detection ability of the antibody.

[0155] In step S106, the population is updated. According to the contribution value of the antibody, some antibodies with higher contribution are selected from the current population and retained, while antibodies with lower contribution are eliminated. Through the update operation, a new antibody population is generated and the next round of iteration is entered. Steps S102 to S106 are repeated until the termination condition is met (such as the number of iterations reaches the set value or the fitness value reaches the preset threshold), and finally the optimal feature combination is output for computer virus detection.

[0156] The present invention starts working by initializing the antibody population and related parameters through the Halton sequence. The goal of this step is to generate a group of random initial antibodies, each antibody represents a potential combination of viral features, and the diversity of the population lays the foundation for subsequent optimization. Subsequently, the contribution value of each antibody is calculated, and the contribution value represents the correlation between the antibody and the target virus feature, that is, the ability of the antibody to recognize the virus feature. According to the contribution value, the antibody is selected, and antibodies with higher contribution are preferentially selected to enter the next cloning stage. The purpose of the selection operation is to retain individuals with higher contribution and provide antibodies with greater potential for the next generation.

[0157] On the basis of selection, high-contribution antibodies are cloned, and the number of clones is proportional to the contribution of the antibody. The goal of the cloning operation is to increase the proportion of high-quality antibodies in the population and improve the optimization efficiency. Subsequently, the cloned antibodies are mutated, and the goal of the mutation is to explore a wider feature space to find a better feature combination.

[0158] After the mutation is completed, antibodies with higher contribution are selected from the mutated antibody set as the excellent antibody set, and the remaining antibodies are randomly supplemented to maintain the population size. This update operation ensures that the population introduces randomness while retaining excellent individuals, thereby preventing it from falling into a local optimal solution. Next, the above calculation, selection, cloning, mutation, and update processes are repeated until the maximum number of iterations is reached or the global convergence of the population is reached. Through continuous iteration, the algorithm gradually optimizes the antibody set to make it closer to the global optimal combination of virus characteristics.

[0159] When the algorithm training is completed, the optimal feature combination is output and a virus feature library is constructed. The virus feature library contains key features for identifying viruses and can serve as the core basis for subsequent virus detection. In the virus detection stage, the virus feature library is used to detect the target virus sample, and the virus type and existence status are determined by matching the features of the virus sample with the content in the feature library. This virus detection method based on feature optimization and antibody models can improve accuracy while ensuring efficient detection, providing effective support for actual virus identification and diagnosis.

[0160] The embodiments of the present invention provide the use of Halton sequence to initialize antibody population and related parameter settings:

[0161] The feature code is extracted using the N-Gram algorithm to convert the features in the program into a set of hexadecimal bytes; the specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form the feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, and parameters such as the mutation rate, the scale of excellent antibodies, and the crossover rate are set.

[0162] The fitness value of each antibody provided in the embodiment of the present invention is calculated as follows:

[0163] The specific method for calculating the maliciousness level is as follows:

[0164]

[0165] where F i is the maliciousness level, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0166] The embodiment of the present invention provides a fitness-distance balance strategy for selecting antibody populations:

[0167] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance from the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0168] Next, the contribution of the antibody is calculated using formula (10): This formula combines the fitness value of the antibody and the distance to the optimal antibody; antibodies with higher contribution are selected for cloning operations;

[0169]

[0170]

[0171] in is the contribution of antibodies, is the normalized distance value, P i represents the ith antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0172] The embodiment of the present invention provides cloning of the selected antibody:

[0173] The number of antibody clones satisfies the following formula:

[0174]

[0175] Where a and b are both constants, and a>0, and max_clone is the maximum number of clones.

[0176] Virus detection provided by the embodiment of the present invention:

[0177] The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0178]

[0179] M={m1,m2,..,m x}Formula (13)

[0180] T={t1,t2,..,t y}Formula (14).

[0181] like Figure 2 As shown, a computer virus detection system based on an improved clone selection algorithm provided by an embodiment of the present invention includes:

[0182] Initialization module, used to initialize antibody population and related parameter settings;

[0183] A calculation module, used to calculate the contribution value of each antibody;

[0184] Selection module, used for selection operation;

[0185] A cloning module, used to clone the selected antibodies;

[0186] The mutation module is used to mutate the cloned antibodies. In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation.

[0187] The update module is used for the update operation; n antibodies with higher contribution are selected from the mutated antibody set as the new excellent antibody set, and then Nn antibodies are randomly added to the antibody set, and the population P' is used as the initial population of the next generation;

[0188] Iteration module, used for iteration; until the maximum number of iterations G is reached max ;

[0189] Output module, used to output the optimal feature combination;

[0190] Virus detection module, used for virus detection.

[0191] In the initialization module, the system receives feature data related to virus detection, initializes the antibody population, each antibody corresponds to a set of possible feature combinations, and sets relevant parameters (such as population size, maximum number of iterations, etc.). Next, the calculation module calculates the fitness value of each antibody based on the input data and the feature combination of the antibody. The fitness value usually reflects the detection ability of the feature fragment to the virus by evaluating the correlation between the feature fragment combination and the virus.

[0192] In the selection module, antibodies are screened based on their contribution values, with high-contribution antibodies being prioritized for cloning operations, while a small number of low-contribution antibodies are retained to maintain population diversity. The cloning module clones the selected antibodies, and the number of clones is proportional to the contribution. The cloning operation expands the population proportion of high-quality antibodies, providing more possibilities for subsequent variation optimization.

[0193] The mutation module mutates the cloned antibodies, introduces new feature combinations, and further explores the optimal solution. The mutation probability is inversely proportional to the affinity (contribution value) of the antibody. The higher the contribution value, the smaller the mutation range of the antibody to protect its excellent characteristics; while the antibody with lower contribution value explores the potential optimal solution through a higher probability of mutation. In the update module, the n antibodies with the highest contribution value are selected from the mutated antibody set as the excellent antibody set, and Nn antibodies are randomly supplemented to maintain the population size to form the initial population of the next generation.

[0194] The iteration module controls the system to enter the next iteration, repeating the fitness calculation, selection, cloning, mutation and update operations until the maximum number of iterations G_max is reached or the fitness meets the preset conditions. Finally, the output module selects the antibody with the highest contribution value from the optimized antibody population, extracts its corresponding optimal feature combination, and uses it for detection and analysis in the virus detection module. This module classifies the input virus sample data based on the optimal feature combination, outputs the virus detection results, and realizes efficient identification of the target virus.

[0195] The present invention provides a computer device, including a memory and a processor. A computer program is stored in the memory, and when the processor executes the program, all steps of the virus detection method based on the improved clone selection algorithm can be implemented. Specifically, the memory is used to store the virus sample data, antibody library and clone selection optimization parameters required by the algorithm, and the processor is responsible for executing the computing tasks in the program, including virus feature extraction, antibody library initialization, cloning and mutation operations, and the final virus detection result output. Through the efficient combination of hardware and algorithm, the device can quickly complete complex virus detection tasks.

[0196] The present invention also provides a computer-readable storage medium for storing computer code for implementing a virus detection program based on an improved clone selection algorithm. The storage medium can be in various forms such as a hard disk, a solid-state drive (SSD), a USB flash drive, or a cloud storage service. When the processor loads the program from the storage medium, it can execute the entire process including dynamic updating of virus data, fast matching of feature vectors, and dynamic optimization of antibody libraries, ensuring that the virus detection system has efficient execution capabilities and flexible adaptability.

[0197] The present invention also provides an information data processing terminal for fully realizing a virus detection system based on an improved clone selection algorithm. The terminal integrates a data acquisition module, a feature analysis module and a result output module, and can extract and process virus-related data from a variety of data sources (such as network traffic, file systems or real-time monitoring devices). By combining with storage media and computer programs, the terminal can not only achieve efficient virus detection, but also support distributed deployment and large-scale data processing, and is suitable for virus detection needs in a variety of scenarios, such as enterprise security, medical diagnosis and network security protection. The present invention improves the clone selection algorithm by introducing a fitness-distance balance strategy to effectively solve the feature selection problem in computer virus detection. By introducing a balance factor δ, the relationship between fitness and distance is balanced, so that more differentiated antibodies are selected, population diversity is increased, and the risk of falling into a local optimum is reduced. Experimental results show that the method proposed in the present invention effectively solves the shortcomings of the original clone selection algorithm in virus feature selection.

[0198] The specific steps of the fitness-distance balance strategy (FDB):

[0199] The first step of the FDB method is to calculate the fitness of each antibody in the population. i is the fitness value of the ith antibody, and formula (1) is the fitness vector F created v .

[0200]

[0201] The second step of the FDB method is to calculate the distance between each antibody and the current optimal antibody according to formula (2). The present invention uses the Euclidean distance for calculation. Formula (3) is the distance vector D of the antibody population. P .

[0202]

[0203]

[0204] The third step of the FDB method is to use the fitness vector F v and the distance vector D P Calculate the contribution value of each antibody to form the contribution vector C P The fitness and distance are normalized so that the two parameters do not dominate each other when calculating the score, and a balance factor δ is used to determine the influence of fitness and distance values ​​on the contribution.

[0205]

[0206]

[0207] In the formula is the contribution of the ith antibody, δ is the balance factor, is the normalized fitness value, is the normalized distance value, C P is the contribution vector of the antibody.

[0208] Original Clone Selection Algorithm (CSA) steps:

[0209] Step 1. Initialize the antibody population: set the population size N, the number of excellent antibodies n, the maximum number of iterations Gmax, the mutation probability p, etc., and use a randomized method to generate a set P containing N antibodies, each of which represents a characteristic fragment combination;

[0210] Step 2. Calculate the antibody fitness: Calculate the maliciousness of each feature fragment combination, and the maliciousness is the antibody fitness;

[0211] Step 3. Selection operation: select n better antibodies from the population P according to fitness to form a set Rn;

[0212] Step 4. Cloning operation: copy the antibodies in the set Rn, the number of copies is positively correlated with the fitness, and the copied antibodies constitute the clone set Rn'.

[0213] Step 5. Mutation operation. Mutate the clone set Rn'. The degree of mutation is negatively correlated with the fitness. The mutated antibodies form the set Rn".

[0214] Step 6. Update operation: Select n antibodies with higher fitness from the mutated set Rn” as the new excellent antibody set P’, and then randomly add Nn antibodies to form the next generation initial population.

[0215] Step 7. Iteration: Repeat step 2 until the maximum number of iterations G is reached max .

[0216] When applying the clone selection algorithm to solve the problem of selecting computer virus signatures, there are two main problems:

[0217] 1. Initialization problem: In step 1, the initialization of antibodies relies on randomization methods, which may lead to uneven distribution of individuals in the population, making it difficult to cover the entire solution space, affecting the convergence accuracy and diversity of the algorithm, and may miss potential excellent solutions;

[0218] 2. Problems with the selection operation: In step 3, the selection operation depends only on fitness. Antibodies with higher fitness are cloned and mutated first, while antibodies with lower fitness are eliminated. This ignores the distance between antibodies and easily causes the antibody population to gather in the local optimal area too early, making it impossible to effectively explore the global solution space and eventually fall into the local optimal solution.

[0219] In order to solve these two problems, the present invention is inspired by the Halton sequence and the fitness-distance balance strategy and proposes an improved clonal selection algorithm.

[0220] The steps of the Improved Clonal Selection Algorithm (ICSA) proposed in the present invention are as follows:

[0221] Input: population size N, excellent antibody size n, maximum number of iterations G max , mutation probability p, balance factor δ;

[0222] Output: Optimal feature combination

[0223] Step 1. Initialize the population: After decoding the characteristic fragments, use the Halton sequence to generate the position map of the characteristic fragments as the antibody population;

[0224] Step 2. Calculate the contribution: First, calculate the fitness of each antibody and antigen in the antibody population P, then use formula (2) to calculate the distance between the current antibody and the optimal antibody, and finally use formula (3) to weight the fitness and distance to obtain the contribution;

[0225] Step 3. Selection operation: select n better antibodies from the antibody set P to form a set Rn according to the contribution;

[0226] Step 4. Cloning operation: clone the antibodies in the set Rn. The number of clones is positively correlated with the fitness. The cloned antibodies constitute the clone set Rn'.

[0227] Step 5. Mutation operation. The clone set Rn' is mutated, and the degree of mutation is negatively correlated with the fitness. The mutated antibodies form the set Rn".

[0228] Step 6. Update. Select the n antibodies with the highest fitness from the mutated antibody set Rn” as the new excellent antibody set P’, and then randomly add Nn antibodies to the antibody set P’, and the population P’ is used as the initial population for the next generation.

[0229] Step 7. Repeat step 2 until the maximum number of iterations G is reached max .

[0230] Step 8. Re-encode the antibodies in the excellent antibody set to obtain a set of characteristic fragments that are more representative of the virus program.

[0231] Halton sequence is a low-discrepancy sequence. The implementation process of Halton sequence is to select prime numbers as the base and continuously divide them to form a set of non-repetitive and uniform points, which improves the scattered distribution problem of random generation. Therefore, using Halton sequence for population initialization can make the population more evenly distributed in the entire solution space, increase population diversity, and thus improve the convergence accuracy of the algorithm.

[0232] Fitness represents the degree of binding between the antibody and the antigen, and the distance represents the difference between the antibody and the current optimal antibody. The larger the distance, the greater the difference between the antibodies, and the more likely they are to make up for each other's shortcomings. Therefore, antibodies with high fitness and long distance contribute more to the search process.

[0233] Computer virus detection process Figure 3 ;

[0234] By screening out a set of feature fragments that are more representative of virus programs according to the improved clone selection algorithm and constructing a virus feature library, suspicious programs can be detected. Feature codes of the program to be detected are extracted and matched with the computer virus feature library constructed by the present invention. Whether the program to be detected is a virus program is determined based on the matching results. If it is a virus program, relevant virus information is given, which can provide reference information for subsequent virus removal work. Compared with the traditional feature code one-to-one comparison method, the model proposed by the present invention makes judgments based on similarity and gives approximate virus features, which helps to detect computer virus variants and unknown computer viruses.

[0235] The following is a detailed description of the technical solution. Detailed steps of the improved clone selection algorithm to solve the virus signature selection problem:

[0236] Step 1: Initialize the antibody population and related parameter settings

[0237] In the present invention, the feature code is extracted by N-Gram algorithm to convert the features in the program into a hexadecimal byte set. The specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form the feature representation of the program. In this way, the potential virus features in the program can be effectively captured, thereby providing a reliable feature basis for feature selection. In order to initialize the antibody population, the Halton sequence is first used to generate 200 different feature combinations, which represent different N-byte sequences or feature fragments. Each antibody represents a combination of a set of feature codes. The initial antibody population constitutes the preliminary solution space of the algorithm.

[0238] The initialization parameter settings are as follows:

[0239] Table 1 Initialization parameter setting table

[0240] Mutation rate Population size Crossover rate Weight Number of clones 0.3 200 0.7 0.5 10 0.3 200 0.7 0.5 10

[0241] Step 2: Calculate the fitness value (i.e., maliciousness) of each antibody

[0242] Malice level is a way to evaluate the relevance of a feature fragment to a virus. It can be measured by calculating the proportion of the feature fragment in all program features. If a feature fragment accounts for a large proportion of all virus programs and a small proportion of normal programs, it means that the feature fragment has a high degree of malice, indicating that it is more representative of virus programs. On the contrary, if the proportion of the feature fragment in virus programs and normal programs is close or small, its malice level is low. The specific method for calculating the malice level is as follows:

[0243]

[0244] where F i is the maliciousness level, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0245] Step 3 Select an action

[0246] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance from the current optimal antibody needs to be calculated first, and this distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0247] Next, the contribution of the antibody is calculated using formula (10): This formula combines the fitness value of the antibody and the distance from the optimal antibody. Antibodies with higher contribution are selected for cloning operations.

[0248]

[0249]

[0250] in is the contribution of antibodies, is the normalized distance value, P irepresents the ith antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0251] Step 4: Cloning of selected antibodies

[0252] After calculating the contribution of each antibody, the next step is to sort the contributions of the antibodies, and then select the top n antibodies with higher contributions for cloning. The number of clones of an antibody is positively correlated with its contribution: the higher the contribution of an antibody, the more clones it has; conversely, antibodies with lower contributions will be cloned less often, or even not cloned at all. This strategy can ensure that the proportion of high-quality antibodies in the population gradually increases, accelerate the spread of excellent solutions, and ultimately effectively improve the fitness level of the entire population. The number of clones satisfies the following formula:

[0253]

[0254] Where a and b are both constants, and a>0, and max_clone is the maximum number of clones.

[0255] Step 5: Mutate the cloned antibody

[0256] In the mutation operation, the higher the contribution of the antibody, the smaller the probability of mutation.

[0257] Step 6 Update Operation

[0258] Select n antibodies with higher contribution from the mutated antibody set as a new excellent antibody set, and then randomly add Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation.

[0259] Step 7 Iteration

[0260] Repeat step 2 until the maximum number of iterations G is reached. max .

[0261] Step 8 Output the optimal feature combination

[0262] After the above steps are completed, the optimal feature combination is output to build a virus feature library.

[0263] Step 9 Virus Detection

[0264] The feature code of the program to be detected is matched with the feature fragment combination stored in the virus feature library. If it is greater than the similarity threshold, it is a virus program, otherwise it is a normal program. The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0265]

[0266] M={m1,m2,..,m x}Formula (13)

[0267] T={t1,t2,..,t y}Formula (14)

[0268] Finally, the present invention verifies through experiments that the original clone selection algorithm has the shortcomings described in Section 2 when applied to computer virus detection to solve the optimal feature combination, and that the improved algorithm based on the fitness-distance balance strategy can solve these shortcomings in a targeted manner. The average of the 100 experimental results is shown in the following table, and the experimental average can intuitively reflect the quality of the algorithm results.

[0269] Table 2 Average results of 1100 virus detections

[0270]

[0271] like Figure 4 From the experimental results, it can be seen that when the termination conditions of the three algorithms belonging to the same evolutionary algorithm cluster are the same, the genetic algorithm and the clonal selection algorithm are not as good as the improved clonal selection algorithm in terms of convergence, and have lower accuracy and higher false alarm rate. The improved clonal selection algorithm (ICSA) performs better, with significantly higher accuracy, lower false alarm rate and better detection rate, indicating that it is more effective in feature selection in virus detection.

[0272] Experimental results show that the algorithm can significantly improve the overall performance of the virus detection system, provide a more accurate and efficient solution to the feature selection problem, and promote the advancement of related technologies.

[0273] This system is mainly divided into user model, virus detection module, and virus database management module. The user module is divided into user registration, user login, and password retrieval. The virus detection module is divided into virus detection and log report. The virus database management module is divided into virus database upgrade, virus database sharing, and virus database management.

[0274] Figure 5 The page shown is a statistics of the number of viruses, showing the number of viruses found each month and the percentage of virus types. The most dangerous viruses found are shown in the list.

[0275] Figure 6 , Figure 7The page shown is the virus detection page. Upload the file to be detected and click the "Confirm Upload" button. The system will detect the file and the detection results will be displayed in the list. The virus detection implementation principle is to traverse the file through a sliding window and compare it with the feature code in the computer virus library. If it matches one of them completely, it will be regarded as a computer virus. If none of them matches, fuzzy matching will be performed. If the matching threshold is reached, it will be regarded as a virus.

[0276] Figure 8 This is the log page, which mainly counts the user's usage. Users can view the test results, test time, risk level, virus name and other information of the personal reported files. They can filter according to the test time, test results and number information to accurately view the records they want to query. This page supports batch export. Check the records to be exported and click the "Batch Export" button to export the record logs as an Excel table.

[0277] Fig. 9 This is the virus database upgrade page. This page is used to upgrade the virus database. Users import training data and test data, select the virus database to be upgraded from the drop-down box, and click "Start Upgrade". After the upgrade is completed, the upgrade result will be displayed in the training result list, along with the number, virus database name, operation time, accuracy and other information. The virus database contains not only the collected computer virus features, but also the computer virus features after the clone selection algorithm multiplies and mutates. The former is to match known computer viruses, and the latter is to match computer variants and unknown viruses.

[0278] Fig.10 This is the virus database sharing page. This page is mainly used to share virus databases between users. Users can upload their own virus databases or download virus databases shared by others. Select your own virus database and enter the shared virus database name in the "Virus Database Name" box. Click the "Confirm Upload" button to upload your own virus database. The list below shows the virus databases shared by all users. Click the "Download" button to download other users' virus databases to this system.

[0279] Fig.11 This is the virus database management page. This page is for users to manage the virus database. By entering the upload time, status, and virus database name to filter, the queried virus database will be displayed in the list below. Users can copy, modify, apply, and discard the virus database to manage the virus database.

[0280] The ICSA virus detection model proposed in the present invention is compared with four common virus detection models on the Henchiri dataset, mainly to compare the detection capabilities of the five models for known viruses.

[0281] Table 3 Comparative experimental results of Henchiri dataset

[0282]

[0283] From the experimental results, we can see that the ICSA detection model performs well in accuracy and false alarm rate, with an accuracy rate of 95.13%, the highest among all models. Although its false alarm rate is 2.47%, slightly higher than the 0.94% of the NaiveBayes model, ICSA still has significant advantages over models such as SMO, ID3 and J48. The ICSA model not only performs well in accurately identifying virus programs, but also effectively reduces the false alarm rate. It is suitable for applications with high security requirements, showing its strong potential in the field of virus detection.

[0284] In order to analyze the comprehensive performance of each model more intuitively, the experimental results are plotted as scatter plots, such as Fig.12 , the closer to the lower right corner, the better the model performance. From the figure, we can see that although the NaiveBayes detection model has a low false alarm rate, its accuracy is far lower than other models. Overall, the ICSA detection model is worse than the other four models.

[0285] This model is compared with the detection model based on signature scanning and the detection model based on behavior analysis, mainly to verify the detection ability of this model for unknown viruses. By reducing the size of the training set and increasing the size of the test set, the model is simulated to detect unknown viruses, which is used to verify whether this model has the ability to detect unknown viruses.

[0286] For this experiment, three groups of control experiments are set up. Each group of control experiments will resample the virus programs and normal programs in the CILPKU08 data set to conduct experimental analysis of the detection rate and false alarm rate. The first group allocates the training set and the test set in a ratio of 4:1, the second group allocates the training set and the test set in a ratio of 1:1, and the third group allocates the training set and the test set in a ratio of 1:4. The specific data division is shown in Table 4. Due to the small amount of divided data, the three groups of experiments will be tested 20 times respectively, and the average value of the detection results will be taken as the experimental result. The specific experimental results are shown in Table 5.

[0287] Table 4 Experimental data division

[0288]

[0289] Table 5 Experimental data of CILPKU08 dataset

[0290]

[0291]

[0292] From the experimental results, it can be seen that the virus detection model based on ICSA is better than the virus detection model based on behavior analysis. The false alarm rate of the virus detection model based on signature scanning is 0, because it is based on a one-to-one accurate match of the signature, so the false alarm rate is 0, but this also makes the detection rate too low.

[0293] In order to analyze the comprehensive performance of each model more intuitively, scatter plots will be drawn for the three groups of control experimental data. Fig.13 , Fig.14 , Fig.15 These are the results of experiments one, two, and three, with the false alarm rate as the vertical axis and the detection rate as the horizontal axis. The closer the scatter plot is to the lower right corner, the higher the overall performance of the model. From the scatter plot, we can see that the overall performance of the virus detection model based on ICSA is better than the other two models. Therefore, it is proved that this model not only has a relatively good ability to detect known viruses, but also has a better ability to detect unknown viruses than the traditional static detection model.

[0294] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0295] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A computer virus detection method based on an improved clone selection algorithm, characterized in that: The following steps are involved: Step 1, use Halton sequence to initialize antibody population and set related parameters; Step 2, calculating the fitness value of each antibody; Step 3, using the fitness-distance balance strategy to select the antibody population; Step 4, cloning the selected antibody; Step 5, mutating the cloned antibody; In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation; Step 6, update operation; Select n antibodies with higher contribution from the mutated antibody set as a new excellent antibody set, and then randomly add Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation; Step 7, iteration; Repeat step 2 until the maximum number of iterations G is reached. max ; Step 8, output the optimal feature combination; After the above steps are completed, the optimal feature combination is output to build a virus feature library; Step 9, virus detection.

2. The computer virus detection method based on the improved clone selection algorithm as claimed in claim 1, characterized in that: The Halton sequence is used to initialize the antibody population and related parameter settings: The feature code is extracted using the N-Gram algorithm to convert the features in the program into a set of hexadecimal bytes. The specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form a feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, and parameters such as the mutation rate, the scale of excellent antibodies, and the crossover rate are set.

3. The computer virus detection method based on the improved clone selection algorithm as claimed in claim 1, characterized in that: The fitness value of each antibody is calculated, that is, the degree of maliciousness: The specific method for calculating the maliciousness is as follows: where F i is the maliciousness level, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

4. The computer virus detection method based on the improved clone selection algorithm as claimed in claim 1, characterized in that: The fitness-distance balance strategy is used to select the antibody population: Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance from the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution. Next, the contribution of the antibody is calculated using formula (10): This formula combines the fitness value of the antibody and the distance between antibodies (the distance between the antibody and the optimal antibody); antibodies with higher contribution are selected for cloning operations; in is the contribution of antibodies, is the normalized distance value, P i represents the ith antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

5. The computer virus detection method based on the improved clone selection algorithm as claimed in claim 1, characterized in that: The selected antibodies are cloned: The number of antibody clones satisfies the following formula: Where a and b are both constants, and a>0, and max_clone is the maximum number of clones.

6. The computer virus detection method based on the improved clone selection algorithm as claimed in claim 1, characterized in that: The virus detection: The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library; M={m1,m2,..,m x }Formula (13) T={t1,t2,..,t y }Formula (14).

7. A virus detection system based on an improved clone selection algorithm for implementing the virus detection method based on an improved clone selection algorithm as claimed in any one of claims 1 to 6, characterized in that: The virus detection system based on the improved clone selection algorithm comprises: Initialization module, used to initialize antibody population and related parameter settings; A calculation module, used to calculate the fitness value of each antibody; Selection module, used for selection operation; A cloning module, used to clone the selected antibodies; The mutation module is used to mutate the cloned antibodies. In the mutation operation, the higher the affinity of the antibody, the lower the probability of mutation. The update module is used for the update operation; the n antibodies with the highest fitness are selected from the mutated antibody set as the new excellent antibody set, and then Nn antibodies are randomly added to the antibody set, and the population P' is used as the initial population of the next generation; Iteration module, used for iteration; until the maximum number of iterations G is reached max ; Output module, used to output the optimal feature combination; Virus detection module, used for virus detection.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the virus detection method based on the improved clone selection algorithm as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the virus detection method based on the improved clone selection algorithm as claimed in any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the virus detection system based on the improved clone selection algorithm as described in claim 7.

Images