A computer virus detection method and system based on improved clone selection algorithm

Abstract

This invention belongs to the field of virus detection technology and discloses a virus detection method based on an improved clonal selection algorithm. The invention enhances population diversity by introducing a Halton sequence for population initialization, overcoming the uneven distribution problem caused by traditional random initialization methods. The evenly distributed population facilitates a more comprehensive exploration of the solution space, thereby enhancing population diversity. It also improves convergence accuracy and reduces the risk of local optimality: By balancing fitness and distance, the invention avoids premature aggregation of antibody populations in local optimal areas, effectively increasing population diversity and driving the search process toward the global optimal solution, thereby reducing the risk of falling into local optimality.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer virus detection, and in particular relates to a computer virus detection method and system based on an improved clone selection algorithm. Background Art

[0002] With the development of network information technology, the internet has become deeply integrated into people's daily lives. In the context of the "Internet Plus" and "5G era," computer viruses are becoming increasingly intelligent, frequent, aggressive, and undetectable, creating an increasingly severe cybersecurity situation.

[0003] How to effectively prevent virus intrusion has become a critical and pressing issue in the field of computer virus detection. Artificial immune algorithms, a branch of machine learning, draw on the principles of self-recognition of antigens in biological immunology and possess strong adaptability, learning, and pattern recognition capabilities. Because computer viruses possess certain life-like and algorithmic characteristics, artificial immune algorithms hold great potential for application in virus detection. Research has demonstrated that artificial immune algorithms offer significant advantages in optimizing feature selection for virus detection systems, enhancing their adaptability and sensitivity to anomalous behavior. By employing artificial immune algorithms, virus detection systems can more efficiently and accurately identify and protect against complex computer viruses, further improving network security.

[0004] Computer virus detection technology typically relies on virus signatures, computer operating status, and abnormal behavior in network traffic to identify network viruses. Static detection technology is the most traditional and commonly used method, typically scanning by comparing virus signatures against a database constructed from signature codes of known viruses. However, this method suffers from lags. If the signature database is not updated promptly, it will be unable to identify newly emerging virus variants. Because signature matching relies on a one-by-one comparison of known signature codes, any changes to the virus program reduce the effectiveness of the signature, making it impossible to identify variant viruses. Therefore, selecting appropriate virus signatures is crucial.

[0005] Through the above analysis, the problems and defects of the existing technology are as follows:

[0006] (1) Static detection technology based on feature scanning: Unable to detect unknown viruses or variant viruses.

[0007] (2) Dynamic detection technology based on behavioral analysis: high false alarm rate, high resource consumption, and unable to cope with virus hiding technology.

[0008] (3) Detection technology based on virtual machines: The model is complex, the false alarm rate is high, and the dependence is strong.

[0009] (4) Hybrid static and dynamic detection technology: The model is complex, the training time is long, and it is difficult to be widely used. Summary of the Invention

[0010] In view of the problems existing in the prior art, the present invention provides a computer virus detection method based on an improved clone selection algorithm.

[0011] The present invention is implemented as follows: a computer virus detection method based on an improved clone selection algorithm comprises:

[0012] Step 1: Use the Halton sequence to initialize the antibody population and set related parameters;

[0013] Step 2, calculate the fitness value of each antibody;

[0014] Step 3: Use the fitness-distance balance strategy to select the antibody population;

[0015] Step 4, cloning the selected antibodies;

[0016] Step 5, mutating the cloned antibody;

[0017] In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation;

[0018] Step 6, update operation;

[0019] Select the n antibodies with the highest contribution from the mutated antibody set as the new excellent antibody set, and then randomly add Nn antibodies to the antibody set. The population P' is used as the initial population of the next generation.

[0020] Step 7, iteration;

[0021] Repeat step 2 until the maximum number of iterations G is reached max ;

[0022] Step 8: Output the optimal feature combination;

[0023] After the above steps are completed, the optimal feature combination is output to build a virus feature library;

[0024] Step 9: Virus detection.

[0025] Furthermore, the Halton sequence is used to initialize the antibody population and related parameter settings:

[0026] The feature code is extracted using the N-Gram algorithm, which converts program features into a set of hexadecimal bytes. Specifically, a sliding window technique is used to extract N-byte sequences from the program to form a feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, while also setting parameters such as the mutation rate, the number of excellent antibodies, and the crossover rate.

[0027] Furthermore, the fitness value of each antibody is calculated:

[0028] The specific fitness value (maliciousness) calculation method is as follows:

[0029]

[0030] Among them F i For maliciousness, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0031] Furthermore, the antibody population is selected using the fitness-distance balance strategy:

[0032] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance to the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0033] Next, the contribution of the antibody is calculated using formula (10) This formula combines the fitness value of the antibody and the distance from the optimal antibody; antibodies with higher contribution are selected for cloning operations;

[0034]

[0035]

[0036] in is the contribution of antibodies, is the normalized distance value, P irepresents the i-th antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0037] Further, the selected antibodies are cloned:

[0038] The number of antibody clones satisfies the following formula:

[0039]

[0040] Where a and b are both constants, a>0, and max_clone is the maximum number of clones.

[0041] Furthermore, the virus detection:

[0042] The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0043]

[0044] M={m1,m2,..,m x}Formula (13)

[0045] T={t1,t2,..,t y}Formula (14).

[0046] Another object of the present invention is to provide a computer virus detection system based on an improved clone selection algorithm, comprising:

[0047] Initialization module, used to initialize the antibody population and related parameter settings;

[0048] A calculation module, used to calculate the contribution value of each antibody;

[0049] Selection module, used for selection operation;

[0050] A cloning module for cloning the selected antibodies;

[0051] The mutation module is used to mutate the cloned antibodies. In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation.

[0052] The update module is used for update operations; the n antibodies with the highest contribution are selected from the mutated antibody set as the new excellent antibody set, and Nn antibodies are randomly added to the antibody set. The population P' is used as the initial population for the next generation;

[0053] Iteration module, used for iteration; until the maximum number of iterations G is reached max;

[0054] Output module, used to output the optimal feature combination;

[0055] Virus detection module, used for virus detection.

[0056] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the virus detection method based on the improved clone selection algorithm.

[0057] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the virus detection method based on the improved clone selection algorithm.

[0058] Another object of the present invention is to provide an information data processing terminal, which is used to implement the virus detection system based on the improved clone selection algorithm.

[0059] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0060] First, the present invention aims to address the problem of traditional static feature scanning detection technology being unable to detect unknown or variant viruses by applying the clonal selection algorithm to the feature selection problem in computer virus detection. As a type of artificial immune algorithm, the clonal selection algorithm simulates the proliferation, differentiation, and mutation mechanisms of immune cells to clone and mutate high-affinity antibodies while simultaneously updating low-affinity antibodies, thereby enhancing the ability to recognize unknown antigens. Although the clonal selection algorithm has novel structural features, it still suffers from insufficient population diversity and a tendency to fall into local optimality. To address this, the present invention improves the clonal selection algorithm.

[0061] This paper proposes a feature selection method based on an improved clonal selection algorithm and applies it to computer virus detection. The original clonal selection algorithm relies on random numbers during the population initialization phase. This randomization method cannot ensure the uniform distribution of individuals in the search space, causing the population to miss part of the search space, thereby affecting convergence accuracy and population diversity. During the selection phase, traditional algorithms use a greedy strategy, relying solely on fitness values ​​to select antibodies. Antibodies with higher fitness are prioritized for cloning and mutation operations, while antibodies with lower fitness are ignored. This method ignores the distance between antibodies and easily causes the antibody population to aggregate in a certain local area, thus falling into a local optimal solution.

[0062] To solve the above problems, the present invention proposes an improved clonal selection algorithm and applies it to the feature code selection in computer virus detection. The improved method first uses the Halton sequence to initialize the population to ensure that the population is evenly distributed in the solution space, thereby increasing the population diversity and improving the convergence accuracy of the algorithm. Secondly, a fitness-distance balance strategy is adopted to select antibodies. Unlike traditional methods, the new strategy not only considers the fitness value of the antibody, but also considers its distance from the current optimal antibody, comprehensively evaluates fitness and distance, and measures the contribution of the antibody more comprehensively. In this way, the algorithm can more comprehensively consider the impact of antibodies on the population when selecting antibodies, thereby guiding the population to evolve in a more promising direction, maintaining diversity, and avoiding premature convergence.

[0063] This paper introduces the Halton sequence and fitness-distance balance strategy. Using the balance factor δ, it balances the relationship between fitness and distance, thereby selecting more differentiated antibodies, increasing population diversity, and reducing the risk of falling into local optima. Experimental results demonstrate that the proposed method effectively addresses the shortcomings of the original clonal selection algorithm in selecting viral features.

[0064] Inspired by the Halton sequence and the fitness-distance balance strategy, this paper proposes a clonal selection algorithm based on the fitness-distance balance strategy, aiming to address the feature selection problem in virus detection. By using the Halton sequence, the individual distribution problem during random initialization is improved, making the population more uniform and increasing population diversity. Furthermore, the fitness-distance balance strategy effectively reduces the risk of premature convergence, thereby improving the algorithm's convergence accuracy.

[0065] Compared with the traditional clonal selection algorithm, the present invention has the following advantages:

[0066] (1) Enhanced population diversity: The Halton sequence is introduced for population initialization, which overcomes the uneven distribution problem caused by the traditional random initialization method. The uniformly distributed population helps to explore the solution space more comprehensively and enhances population diversity.

[0067] (2) Improve convergence accuracy and reduce the risk of local optimality: By balancing fitness and distance, the present invention avoids the antibody population from gathering in the local optimal area too early, effectively increases the population diversity, and promotes the search process to move closer to the global optimal solution, thereby reducing the risk of falling into the local optimal solution.

[0068] Second, as auxiliary evidence for the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0069] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0070] 1. Enhanced Market Competitiveness: With the increasing demand for efficient virus detection technology in the cybersecurity field, particularly in emerging areas such as the Internet of Things, cloud computing, and smart devices, the demand for virus detection systems continues to grow. This invention provides an innovative virus detection method with strong market competitiveness, poised to capture a niche in the global cybersecurity market. Through technology licensing, technology transfer, and collaborative development, the commercialization of this invention can generate substantial revenue for companies, boosting their position and brand influence in the cybersecurity industry.

[0071] 2. Driving innovation and development in the cybersecurity industry chain: This invention is not just a technological innovation; it also has far-reaching implications for the entire cybersecurity industry chain. Through collaboration with antivirus software vendors, enterprise cybersecurity service providers, and government agencies, this invention can drive technological advancement across the entire industry chain. For example, antivirus software vendors can integrate the technology of this invention into existing products to enhance their market competitiveness. Furthermore, the technological innovations of this invention can also facilitate the exploration of new business models, such as the launch of new security services such as intelligent virus protection systems based on artificial immune algorithms and cloud-based virus monitoring platforms.

[0072] (2) The technical solution of the present invention fills the technical gap in the industry at home and abroad:

[0073] 1. Application of an Improved Clonal Selection Algorithm: Traditional clonal selection algorithms for virus feature selection commonly face problems such as uneven population initialization and premature convergence. These issues severely impact the algorithm's global search capabilities and convergence accuracy. While some studies have attempted to improve algorithm performance by improving initialization strategies or adjusting selection mechanisms, these technical bottlenecks have yet to be effectively addressed. This invention introduces a fitness-distance balance strategy to guide the evolution of the population, avoiding localized population concentration and fundamentally improving the algorithm's global search capabilities.

[0074] 2. Technological Breakthrough in Virus Detection Systems: Existing virus detection systems primarily rely on signature library matching and static scanning, and are unable to address the proliferation of new virus variants. This is particularly true when facing large-scale, complex network attacks, where existing systems often suffer from a high rate of missed detections. By introducing an improved clonal selection algorithm, this invention offers a completely new approach to virus detection, addressing the current inability of existing technologies to effectively handle new viruses and malware.

[0075] (3) The technical solution of the present invention solves the technical problems that people have been eager to solve but have never been able to solve successfully:

[0076] 1. Detection of New Virus Variants: The constant mutation of computer viruses and the rapid emergence of new viruses are among the greatest challenges facing virus detection technology. Traditional static virus detection methods rely on a library of known virus signatures. However, with the rapid evolution of virus variants, signature library updates lag, making it difficult to detect new viruses in a timely manner. This invention introduces an improved clonal selection algorithm that dynamically learns and selects the most relevant virus signatures in real time, significantly improving the system's adaptability and accuracy in identifying new viruses, effectively addressing the problem of difficulty in detecting new virus variants in a timely manner.

[0077] 2. Algorithm optimization challenges: Traditional clonal selection algorithms are prone to falling into local optimal solutions during feature selection, affecting the algorithm's convergence accuracy and performance. Many researchers have tried various optimization methods, but most have not fully addressed this issue. By introducing Halton sequence initialization and a fitness-distance balance strategy, this paper provides an effective solution that significantly improves the efficiency and accuracy of feature selection, avoids the problem of local optimal solutions, and promotes the overall advancement of virus detection technology.

[0078] (4) The technical solution of the present invention overcomes technical prejudice:

[0079] 1. Overcoming the bias towards local optimal solutions: Traditional clonal selection algorithms often rely on fitness values ​​to select antibodies, which can easily lead to population aggregation in a certain local area, leading to the dilemma of local optimal solutions. Although many improved methods have proposed strategies to enhance diversity and avoid premature convergence, most still fail to fully overcome this bottleneck. By introducing a fitness-distance balance strategy, the present invention effectively avoids this bias and facilitates the implementation of global search.

[0080] 2. Overcoming random initialization bias: Traditional clonal selection algorithms typically use random numbers to initialize the population, which can lead to uneven distribution of individuals in the search space, affecting search efficiency. Although some improved algorithms have attempted to use other initialization methods, most have failed to completely resolve this issue. This invention uses the Halton sequence to ensure a uniform distribution of the population in the solution space, overcoming the bias of traditional random initialization methods and significantly improving search capabilities.

[0081] Third, traditional computer virus detection technologies often rely on manual experience or simple statistical methods during feature selection, making them incapable of handling the diverse and complex nature of virus signature data. This approach is not only time-consuming but can also miss important features, resulting in ineffective computer virus detection. This invention, through an improved clonal selection algorithm, rapidly selects the most representative feature combinations from massive amounts of virus signature data, significantly reducing feature dimensionality and eliminating redundant and unused features, significantly improving the efficiency and quality of feature selection.

[0082] Existing computer virus detection models often face problems such as insufficient accuracy and high false positive rates when processing complex data, making them inadequate for complex and diverse application scenarios. This paper employs an improved clonal selection algorithm to select virus signatures, significantly improving the model's detection accuracy and stability, ensuring its applicability to a wide range of computer virus detection tasks.

[0083] This invention improves the entire process of computer virus detection, from feature selection to model optimization, addressing the efficiency bottlenecks and performance limitations of traditional methods. Through multiple rounds of iterative optimization, the optimal feature combination is ultimately output, achieving higher detection accuracy and robustness. This technology has significant industrial value in scenarios such as network security, information system protection, and anti-emergency computer virus research, providing efficient and reliable technical support for data center protection, enterprise network security, and software supply chain security.

[0084] Fourth, existing technical problems:

[0085] Traditional computer virus detection methods mainly rely on virus signature library matching or rule-based static analysis technology, which has the following major problems:

[0086] 1) Unable to quickly adapt to new viruses: The rapid generation of new and variant viruses makes it difficult to update static analysis based on feature libraries in a timely manner, resulting in a lower detection rate.

[0087] 2) High false alarm rate: The ability to distinguish the characteristics of normal programs and virus programs is limited, which easily leads to high false alarm and missed alarm rates.

[0088] 3) Inefficiency: Traditional methods require scanning a large number of program features or samples one by one, which is time-consuming and cannot meet the needs of real-time detection.

[0089] 4) Insufficient dynamic behavior analysis: Unable to effectively capture the dynamic behavior characteristics of the virus during operation.

[0090] Improvements to the algorithm and mathematical model of the present invention:

[0091] 1) Dynamically initialize the antibody population:

[0092] By using the Halton sequence to generate an initial antibody population with a global distribution and combining it with the N-Gram algorithm to extract program features, a more efficient viral feature representation is achieved. Compared to traditional random initialization methods, the Halton sequence provides a more uniform population distribution, ensuring that the algorithm covers a wider search space in the initial stage.

[0093] 2) Calculation of maliciousness:

[0094] The maliciousness model is used to combine the statistical information of the features of virus programs and normal programs to quantify the importance and distribution characteristics of the features. By calculating the probability and frequency distribution of the features in viruses and normal programs, formulas (7) and (8) ensure that the calculation of the maliciousness has stronger distinguishing ability.

[0095] 3) Fitness-distance balance strategy:

[0096] During the antibody selection process, the similarity between antibodies is calculated using formula (9), and the normalized fitness value and normalized distance value of formula (10) are combined to balance the contribution and diversity of antibodies. This strategy effectively avoids the algorithm from falling into local optimality and enhances the diversity of the antibody population and the global search capability.

[0097] 4) Cloning and optimization:

[0098] Formula (11) is used to dynamically allocate the number of antibody clones and adjust the clone ratio according to the contribution of the antibody. Dynamic mutation operations are used to enhance the antibody exploration capability and ensure that the coverage of the optimized antibody is more consistent with the feature library.

[0099] 5) Cosine similarity virus detection:

[0100] In the virus detection stage, the similarity between the features of the program to be detected and the virus feature library is calculated by formula (12), and the cosine distance is combined to quantify the matching degree, thereby improving the accuracy of detection.

[0101] Significant technological advancements:

[0102] 1) Improve virus detection efficiency:

[0103] The dynamically initialized and optimized clone selection algorithm significantly reduces the search time and computing resource consumption during virus detection, especially showing higher efficiency in large-scale sample analysis.

[0104] 2) Detection accuracy is significantly improved:

[0105] The antibody selection strategy based on fitness-distance balance and the cosine similarity calculation model can more accurately distinguish virus characteristics from normal characteristics and reduce false alarm and missed alarm rates.

[0106] 3) Enhanced detection capabilities for unknown viruses:

[0107] Through dynamic learning of features and optimization, the present invention can effectively identify new viruses and variants not included in the feature library, thereby improving the ability to detect unknown threats.

[0108] 4) Wide applicability and scalability:

[0109] The present invention is not only applicable to conventional static analysis scenarios, but can also be extended to multiple fields such as dynamic behavior analysis and network threat detection, and has great application potential and commercial value. BRIEF DESCRIPTION OF THE DRAWINGS

[0110] Figure 1 This is a flow chart of a virus detection method based on an improved clone selection algorithm provided by an embodiment of the present invention.

[0111] Figure 2 This is a structural block diagram of a virus detection system based on an improved clone selection algorithm provided by an embodiment of the present invention.

[0112] Figure 3 This is a detailed flow chart of virus detection based on the improved clone selection algorithm provided by an embodiment of the present invention.

[0113] Figure 4 1 is a detection rate diagram of the three algorithms provided in the embodiment of the present invention.

[0114] Figure 5 This is a picture of the virus quantity statistics page.

[0115] Figure 6 This is the virus detection page image.

[0116] Figure 7 This is the interface showing the virus detection scan results.

[0117] Figure 8 This is the log report page diagram.

[0118] Figure 9 This is the virus database upgrade page.

[0119] Figure 10 This is a picture of the virus database sharing page.

[0120] Figure 11 This is the virus database management page.

[0121] Figure 12 It is a scatter plot of the Henchiri data set comparison experiment.

[0122] Figure 13 This is the scatter plot of Experiment 1.

[0123] Figure 14 This is the scatter plot of Experiment 2.

[0124] Figure 15 This is the scatter plot of Experiment 3. DETAILED DESCRIPTION

[0125] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0126] The following are two specific application examples of the computer virus detection system based on the improved clone selection algorithm:

[0127] 1. Optimization of cloud storage file virus detection features

[0128] Application Scenario: In cloud storage services, user-uploaded files may contain hidden computer viruses, which can spread widely through file sharing. Due to the diverse file types and complex virus signatures, accurately extracting virus file detection signatures is critical.

[0129] System Application: The system uses the initialization file features of the present invention (such as file hash values, specific code snippets, and executable behaviors) as the antibody population. The antibody fitness value is used to evaluate the accuracy and false positive rate of each feature in virus file detection. Through multiple rounds of feature selection, cloning, mutation, and optimization iterations, the system ultimately outputs the feature combination with the highest fitness value, which is used to build a cloud storage computer virus detection model, improving the efficiency of virus file detection.

[0130] Practical significance: The optimized file feature combination can quickly locate virus files in cloud storage, prevent virus spread, improve the security of cloud storage platforms, and provide reliable protection for user data.

[0131] 2. Malware detection in enterprise network security environments

[0132] Application Scenario: In enterprise networks, malware poses a serious threat to business security. Due to the diverse and volatile nature of malware, traditional signature-based detection methods struggle to respond to complex threats in a timely manner. This requires extracting key features from massive amounts of network traffic and terminal data for real-time analysis.

[0133] System Application: The system receives network traffic logs, endpoint file behavior records, and threat intelligence data, and initializes a feature population based on typical malware characteristics (such as behavioral patterns, communication protocols, and code snippets). Using a clonal selection algorithm for optimization, the system extracts the most discriminative feature combinations and labels potentially threatening files or activities in real time.

[0134] Practical significance: Optimized computer virus detection models can significantly improve malware detection accuracy and response speed, helping enterprises discover and prevent the spread of malware in the early stages and protect critical data and systems from damage.

[0135] These two examples demonstrate the system's potential for broad application in cloud storage security and enterprise network security. They both demonstrate efficient and accurate computer virus detection and protection capabilities, providing strong security protection for cloud platforms and enterprise network environments.

[0136] like Figure 1 As shown, a computer virus detection method based on an improved clone selection algorithm provided by an embodiment of the present invention includes the following steps:

[0137] S101, use Halton sequence to initialize antibody population and related parameter settings;

[0138] S102, calculating the fitness value of each antibody;

[0139] S103, using the fitness-distance balance strategy to select the antibody population;

[0140] S104, cloning of selected antibodies;

[0141] S105, mutation of cloned antibodies;

[0142] In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation;

[0143] S106, update operation;

[0144] Select the n antibodies with the highest contribution from the mutated antibody set as the new excellent antibody set, and then randomly add Nn antibodies to the antibody set. The population P' is used as the initial population of the next generation.

[0145] S107, iteration;

[0146] Repeat S102 until the maximum number of iterations G is reached max ;

[0147] S108, outputting the optimal feature combination;

[0148] After the above steps are completed, the optimal feature combination is output to build a virus feature library;

[0149] S109, virus detection.

[0150] In step S101, the Halton sequence is first used to initialize the antibody population, which consists of multiple individual antibodies. Relevant parameters are set, including population size, number of clones, mutation probability, and termination conditions. Proper parameter settings ensure population diversity and algorithm stability, providing a foundation for subsequent optimization.

[0151] In step S102, the fitness value of each antibody is calculated based on the virus detection sample data. The fitness value reflects the effectiveness of the antibody in identifying virus samples and is usually measured by the degree of maliciousness. By calculating the fitness value, the antibodies with higher performance in the current population are identified, providing a basis for subsequent selection operations.

[0152] In step S103, antibodies are selected based on the fitness-distance balance strategy, with antibodies with higher contribution values ​​being prioritized for the next round of cloning. The selection mechanism uses the fitness-distance balance strategy to maintain population diversity and prevent premature convergence.

[0153] In step S104, the selected antibodies are cloned. The number of clones is proportional to the antibody's contribution value; antibodies with higher contribution values ​​generate more clones. The purpose of the cloning operation is to increase the proportion of high-quality antibodies in the population, laying the foundation for the next step of variant optimization.

[0154] In step S105, the clones are mutated to introduce population diversity. The probability of mutation is inversely proportional to the antibody's affinity (contribution value). Antibodies with higher contribution values ​​have a lower probability of mutation and a smaller amplitude of mutation, thereby protecting their superior properties. Antibodies with lower contribution values ​​have a higher probability of mutation to explore new solution spaces. Mutation can be achieved by fine-tuning or randomly perturbing the feature vector, aiming to further optimize the antibody's virus detection capabilities.

[0155] In step S106, the population is updated. Based on the contribution values ​​of the antibodies, some antibodies with higher contributions are selected from the current population and retained, while antibodies with lower contributions are eliminated. Through the update operation, a new antibody population is generated and the next round of iteration begins. Steps S102 to S106 are repeated until the termination condition is met (such as the number of iterations reaches a set value or the fitness value reaches a preset threshold), and the optimal feature combination is finally output for computer virus detection.

[0156] The present invention begins work by initializing the antibody population and related parameters through the Halton sequence. The goal of this step is to generate a group of random initial antibodies, each antibody represents a potential combination of viral characteristics, and the diversity of the population lays the foundation for subsequent optimization. Subsequently, the contribution value of each antibody is calculated. The contribution value represents the correlation between the antibody and the target virus characteristics, that is, the ability of the antibody to recognize the viral characteristics. According to the contribution value, the antibody is selected, and antibodies with higher contribution are preferentially selected to enter the next cloning stage. The purpose of the selection operation is to retain individuals with higher contribution while providing antibodies with greater potential for the next generation.

[0157] Following this selection, highly contributing antibodies are cloned, with the number of clones proportional to their contribution. The goal of this cloning operation is to increase the proportion of high-quality antibodies in the population and improve optimization efficiency. Subsequently, these cloned antibodies are mutated, with the goal of exploring a wider feature space to discover more optimal feature combinations.

[0158] After mutation is complete, antibodies with high contributions are selected from the mutated antibody set as the "Excellent Antibody Set," and the remaining antibodies are randomly supplemented to maintain the population size. This update operation ensures that the population introduces randomness while retaining excellent individuals, thus preventing regression into local optimal solutions. Next, the above calculation, selection, cloning, mutation, and update processes are repeated until the maximum number of iterations is reached or the population reaches global convergence. Through continuous iteration, the algorithm gradually optimizes the antibody set, bringing it closer to the globally optimal combination of viral characteristics.

[0159] Once the algorithm is trained, it outputs the optimal feature combination and constructs a virus signature library. This library contains key features for identifying viruses and serves as the core basis for subsequent virus detection. During the virus detection phase, the virus signature library is used to test target virus samples. By matching the sample's features with the library's content, the virus type and presence status are determined. This virus detection method, based on feature optimization and antibody models, ensures efficient detection while improving accuracy, providing effective support for actual virus identification and diagnosis.

[0160] The embodiments of the present invention provide the use of Halton sequences to initialize antibody populations and related parameter settings:

[0161] The feature code is extracted using the N-Gram algorithm, which converts program features into a set of hexadecimal bytes. Specifically, a sliding window technique is used to extract N-byte sequences from the program to form a feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, while also setting parameters such as the mutation rate, the number of excellent antibodies, and the crossover rate.

[0162] The fitness value of each antibody provided in the embodiment of the present invention is calculated as follows:

[0163] The specific method for calculating the maliciousness level is as follows:

[0164]

[0165] Among them F i For maliciousness, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0166] The embodiment of the present invention provides a fitness-distance balance strategy for selecting an antibody population:

[0167] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance to the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0168] Next, the contribution of the antibody is calculated using formula (10) This formula combines the fitness value of the antibody and the distance from the optimal antibody; antibodies with higher contribution are selected for cloning operations;

[0169]

[0170]

[0171] in is the contribution of antibodies, is the normalized distance value, P i represents the i-th antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0172] The embodiment of the present invention provides cloning of the selected antibodies:

[0173] The number of antibody clones satisfies the following formula:

[0174]

[0175] Where a and b are both constants, a>0, and max_clone is the maximum number of clones.

[0176] Virus detection provided by the embodiment of the present invention:

[0177] The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0178]

[0179] M={m1,m2,..,m x}Formula (13)

[0180] T={t1,t2,..,t y}Formula (14).

[0181] like Figure 2 As shown, an embodiment of the present invention provides a computer virus detection system based on an improved clone selection algorithm, including:

[0182] Initialization module, used to initialize the antibody population and related parameter settings;

[0183] A calculation module, used to calculate the contribution value of each antibody;

[0184] Selection module, used for selection operation;

[0185] A cloning module for cloning the selected antibodies;

[0186] The mutation module is used to mutate the cloned antibodies. In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation.

[0187] The update module is used for update operations; n antibodies with higher contribution are selected from the mutated antibody set as the new excellent antibody set, and Nn antibodies are randomly added to the antibody set. The population P' is used as the initial population for the next generation;

[0188] Iteration module, used for iteration; until the maximum number of iterations G is reached max ;

[0189] Output module, used to output the optimal feature combination;

[0190] Virus detection module, used for virus detection.

[0191] In the initialization module, the system receives feature data related to virus detection, initializes the antibody population, and sets relevant parameters (such as population size and maximum number of iterations) for each antibody. Next, the calculation module calculates the fitness value of each antibody based on the input data and the antibody's feature combination. The fitness value is typically measured by evaluating the correlation between the feature segment combination and the virus, reflecting the feature segment's ability to detect the virus.

[0192] In the selection module, antibodies are screened based on their contribution values, prioritizing high-contribution antibodies for cloning while retaining a small number of low-contribution antibodies to maintain population diversity. The cloning module clones the selected antibodies, with the number of clones proportional to their contribution. This cloning operation expands the population of high-quality antibodies, providing more possibilities for subsequent mutation optimization.

[0193] The mutation module mutates the cloned antibodies, introducing new feature combinations to further explore optimal solutions. The mutation probability is inversely proportional to the antibody's affinity (contribution value). Antibodies with higher contribution values ​​have smaller mutations to protect their excellent properties; antibodies with lower contribution values, on the other hand, have a higher probability of mutation to explore potential optimal solutions. In the update module, the n antibodies with the highest contribution values ​​are selected from the mutated antibody set as the excellent antibody set. Meanwhile, Nn antibodies are randomly added to maintain the population size to form the initial population for the next generation.

[0194] The iteration module controls the system's entry into the next iteration, repeating fitness calculation, selection, cloning, mutation, and update operations until the maximum number of iterations G_max is reached or the fitness meets a preset condition. Finally, the output module selects the antibody with the highest contribution value from the optimized antibody population, extracts its corresponding optimal feature combination, and uses it for detection and analysis in the virus detection module. This module classifies the input virus sample data based on the optimal feature combination and outputs the virus detection results, achieving efficient identification of the target virus.

[0195] The present invention provides a computer device comprising a memory and a processor. The memory stores a computer program that, when executed by the processor, implements all steps of a virus detection method based on an improved clone selection algorithm. Specifically, the memory stores the virus sample data, antibody library, and clone selection optimization parameters required by the algorithm. The processor is responsible for executing the computational tasks in the program, including virus feature extraction, antibody library initialization, cloning and mutation operations, and the final output of virus detection results. Through the efficient combination of hardware and algorithms, the device can rapidly complete complex virus detection tasks.

[0196] The present invention also provides a computer-readable storage medium for storing computer code that implements a virus detection program based on an improved clonal selection algorithm. The storage medium can be in various forms, such as a hard disk, a solid-state drive (SSD), a USB flash drive, or a cloud storage service. After the processor loads the program from the storage medium, it can execute the entire process, including dynamic updating of virus data, rapid matching of feature vectors, and dynamic optimization of the antibody library, ensuring that the virus detection system has efficient execution capabilities and flexible adaptability.

[0197] The present invention also provides an information data processing terminal for fully realizing a virus detection system based on an improved clone selection algorithm. The terminal integrates a data acquisition module, a feature analysis module and a result output module, and can extract and process virus-related data from a variety of data sources (such as network traffic, file systems or real-time monitoring equipment). By combining with storage media and computer programs, the terminal can not only achieve efficient virus detection, but also support distributed deployment and large-scale data processing, and is suitable for virus detection needs in a variety of scenarios, such as enterprise security, medical diagnosis and network security protection. The present invention improves the clone selection algorithm by introducing a fitness-distance balance strategy to effectively solve the feature selection problem in computer virus detection. By introducing a balance factor δ, the relationship between fitness and distance is balanced, thereby selecting more differentiated antibodies, increasing population diversity, and reducing the risk of falling into local optimality. Experimental results show that the method proposed in the present invention effectively solves the shortcomings of the original clone selection algorithm in virus feature selection.

[0198] The specific steps of the fitness-distance balance strategy (FDB):

[0199] The first step of the FDB method is to calculate the fitness of each antibody in the population. i is the fitness value of the ith antibody, and formula (1) is the fitness vector F created v .

[0200]

[0201] The second step of the FDB method is to calculate the distance between each antibody and the current optimal antibody according to formula (2). The present invention uses Euclidean distance for calculation. Formula (3) is the distance vector D of the antibody population. P .

[0202]

[0203]

[0204] The third step of the FDB method is to use the fitness vector F v and the distance vector D P Calculate the contribution value of each antibody to form the contribution vector C P The fitness and distance are normalized so that the two parameters do not dominate each other when calculating the score, and a balance factor δ is used to determine the influence of fitness and distance values ​​on the contribution.

[0205]

[0206]

[0207] In the formula is the contribution of the i-th antibody, δ is the balance factor, is the normalized fitness value, is the normalized distance value, C P is the contribution vector of the antibody.

[0208] Original Clone Selection Algorithm (CSA) steps:

[0209] Step 1. Initialize the antibody population: set the population size N, the number of excellent antibodies n, the maximum number of iterations Gmax, the mutation probability p, etc., and use a randomized method to generate a set P containing N antibodies, each of which represents a characteristic fragment combination;

[0210] Step 2. Calculate the antibody fitness: Calculate the maliciousness of each feature fragment combination. The maliciousness is the antibody fitness;

[0211] Step 3. Selection operation: select n better antibodies from the population P according to fitness to form a set Rn;

[0212] Step 4. Cloning operation: copy the antibodies in the set Rn. The number of copies is positively correlated with the fitness. The copied antibodies constitute the clone set Rn'.

[0213] Step 5. Mutation operation. Mutate the clone set Rn'. The degree of mutation is negatively correlated with fitness. The mutated antibodies form the set Rn".

[0214] Step 6. Update operation: Select n antibodies with higher fitness from the mutated set Rn” as the new excellent antibody set P’, and then randomly add Nn antibodies to form the next generation initial population.

[0215] Step 7. Iteration: Repeat step 2 until the maximum number of iterations G is reached max .

[0216] When applying the clonal selection algorithm to solve the problem of selecting computer virus signature codes, there are two main problems:

[0217] 1. Initialization problem: In step 1, the initialization of antibodies relies on randomization methods, which may lead to uneven distribution of individuals in the population, making it difficult to cover the entire solution space, affecting the convergence accuracy and diversity of the algorithm, and may even miss potential excellent solutions;

[0218] 2. Problems with the selection operation: In step 3, the selection operation relies solely on fitness. Antibodies with higher fitness are cloned and mutated first, while antibodies with lower fitness are eliminated. This ignores the distance between antibodies and easily causes the antibody population to gather in the local optimal area too early, making it impossible to effectively explore the global solution space and eventually fall into the local optimal solution.

[0219] In order to solve these two problems, the present invention is inspired by the Halton sequence and the fitness-distance balance strategy and proposes an improved clonal selection algorithm.

[0220] The steps of the Improved Clonal Selection Algorithm (ICSA) proposed in the present invention are as follows:

[0221] Input: population size N, excellent antibody size n, maximum number of iterations G max , mutation probability p, balance factor δ;

[0222] Output: Optimal feature combination

[0223] Step 1. Initialize the population: After decoding the characteristic fragments, use the Halton sequence to generate the position map of the characteristic fragments as the antibody population;

[0224] Step 2. Calculate the contribution: First, calculate the fitness of each antibody in the antibody population P and the antigen. Then, use formula (2) to calculate the distance between the current antibody and the optimal antibody. Finally, use formula (3) to weight the fitness and distance to obtain the contribution.

[0225] Step 3. Selection operation: select n better antibodies from the antibody set P according to the size of the contribution to form a set Rn;

[0226] Step 4. Cloning operation: clone the antibodies in the set Rn. The number of clones is positively correlated with the fitness. The cloned antibodies constitute the clone set Rn'.

[0227] Step 5. Mutation operation. Mutate the clone set Rn'. The degree of mutation is negatively correlated with fitness. The mutated antibodies form the set Rn".

[0228] Step 6. Update. Select the n antibodies with the highest fitness from the mutated antibody set Rn” as the new excellent antibody set P’. Then randomly add Nn antibodies to the antibody set P’. The population P’ serves as the initial population for the next generation.

[0229] Step 7. Repeat step 2 until the maximum number of iterations G is reached max .

[0230] Step 8. Re-encode the antibodies in the excellent antibody set to obtain a set of characteristic fragments that are more representative of the virus program.

[0231] The Halton sequence is a low-discrepancy sequence. Its implementation involves selecting a prime number as the base and continuously dividing it to form a set of non-repeating and uniform points, improving the scattered distribution problem of random generation. Therefore, using the Halton sequence for population initialization can make the population more evenly distributed across the solution space, increasing population diversity and thus improving the algorithm's convergence accuracy.

[0232] Fitness represents the degree of binding between the antibody and the antigen, and distance represents the difference between the antibody and the current optimal antibody. The larger the distance, the greater the difference between the antibodies, and the more likely they are to make up for each other's shortcomings. Therefore, antibodies with high fitness and long distance contribute more to the search process.

[0233] Computer virus detection process Figure 3 ;

[0234] By using an improved clonal selection algorithm to screen out a collection of characteristic fragments that are more representative of virus programs and constructing a virus signature library, suspicious programs can be detected. Feature codes are extracted from the program to be detected and matched against the computer virus signature library constructed by the present invention. Based on the matching results, the program to be detected is determined to be a virus program. If it is a virus program, relevant virus information is provided, providing reference information for subsequent virus removal. Compared to the traditional method of comparing feature codes one by one, the model proposed in this invention determines based on similarity, providing approximate virus signatures, which helps detect computer virus variants and unknown computer viruses.

[0235] The following is a detailed description of the technical solution. Detailed steps for solving the virus signature selection problem using the improved clone selection algorithm:

[0236] Step 1: Initialize the antibody population and related parameter settings

[0237] In the present invention, the feature code is extracted using the N-Gram algorithm to convert the features in the program into a set of hexadecimal bytes. The specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form a feature representation of the program. In this way, the potential virus features in the program can be effectively captured, thereby providing a reliable feature basis for feature selection. In order to initialize the antibody population, the Halton sequence is first used to generate 200 different feature combinations, which represent different N-byte sequences or feature fragments. Each antibody represents a combination of a set of feature codes. The initial antibody population constitutes the preliminary solution space of the algorithm.

[0238] The initialization parameter settings are as follows:

[0239] Table 1 Initialization parameter setting table

[0240] mutation rate Population size Crossover rate Weight Number of clones 0.3 200 0.7 0.5 10 0.3 200 0.7 0.5 10

[0241] Step 2: Calculate the fitness value (i.e., maliciousness) of each antibody

[0242] The maliciousness level is a way to assess the relevance of a particular feature fragment to a virus. It can be measured by calculating the proportion of that feature fragment in all program features. If a feature fragment accounts for a large proportion of all virus programs and a small proportion of all normal programs, then the maliciousness level of that feature fragment is high, indicating that it is more representative of virus programs. Conversely, if the proportion of that feature fragment in virus programs and normal programs is relatively close or small, then its maliciousness level is low. The specific maliciousness level calculation method is as follows:

[0243]

[0244] Among them F i For maliciousness, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i.

[0245] Step 3: Select an action

[0246] Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating antibody contribution. Specifically, for each antibody, its distance to the current optimal antibody must first be calculated, measured using formula (9). This distance reflects the gap between the antibody's position in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution.

[0247] Next, the contribution of the antibody is calculated using formula (10) This formula combines the fitness value of the antibody and the distance from the optimal antibody. The antibody with the highest contribution is selected for cloning.

[0248]

[0249]

[0250] in is the contribution of antibodies, is the normalized distance value, P irepresents the i-th antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

[0251] Step 4: Cloning of selected antibodies

[0252] After calculating the contribution of each antibody, the next step is to sort the contributions of the antibodies and select the top n antibodies with the highest contributions for cloning. The number of antibody clones is positively correlated with its contribution: the higher the contribution, the more clones it has; conversely, antibodies with lower contributions will be cloned less frequently or not at all. This strategy ensures that the proportion of high-quality antibodies in the population gradually increases, accelerates the spread of excellent solutions, and ultimately effectively improves the fitness level of the entire population. The number of antibody clones satisfies the following formula:

[0253]

[0254] Where a and b are both constants, a>0, and max_clone is the maximum number of clones.

[0255] Step 5: Mutate the cloned antibody

[0256] In the mutation operation, the higher the contribution of the antibody, the smaller the probability of mutation.

[0257] Step 6 Update Operation

[0258] From the mutated antibody set, n antibodies with higher contributions are selected as a new excellent antibody set, and then Nn antibodies are randomly added to the antibody set. The population P' is used as the initial population for the next generation.

[0259] Step 7 Iteration

[0260] Repeat step 2 until the maximum number of iterations G is reached max .

[0261] Step 8 Output the optimal feature combination

[0262] After the above steps are completed, the optimal feature combination is output to build a virus feature library.

[0263] Step 9 Virus Detection

[0264] The feature code of the program to be detected is matched with the feature fragment combination stored in the virus feature library. If it is greater than the similarity threshold, it is a virus program, otherwise it is a normal program. The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library;

[0265]

[0266] M={m1,m2,..,m x}Formula (13)

[0267] T={t1,t2,..,t y}Formula (14)

[0268] Finally, this paper experimentally demonstrates that the original clonal selection algorithm suffers from the shortcomings described in Section 2 when applied to finding the optimal feature combination for computer virus detection, and that an improved algorithm based on the fitness-distance balance strategy can effectively address these shortcomings. The average results of 100 experiments are shown in the table below. These averages provide a clear indicator of the quality of the algorithm's results.

[0269] Table 2 Average results of 100 virus detections

[0270]

[0271] like Figure 4 The experimental results show that when the termination conditions of the three algorithms in the same evolutionary algorithm family are the same, the genetic algorithm and the clonal selection algorithm are not as good as the improved clonal selection algorithm in terms of convergence, resulting in lower accuracy and higher false positive rates. The improved clonal selection algorithm (ICSA) performs even better, with significantly higher accuracy, lower false positive rates, and better detection rates, demonstrating its greater effectiveness in feature selection for virus detection.

[0272] Experimental results show that the algorithm can significantly improve the overall performance of the virus detection system, provide a more accurate and efficient solution to the feature selection problem, and promote the advancement of related technologies.

[0273] The system is primarily divided into a user model, a virus detection module, and a virus database management module. The user module includes user registration, user login, and password retrieval. The virus detection module includes virus detection and log reporting. The virus database management module includes virus database upgrades, virus database sharing, and virus database management.

[0274] Figure 5 The page shown here provides virus statistics, showing the number of viruses discovered each month and the percentage of virus types. The list shows the most dangerous viruses discovered.

[0275] Figure 6 、 Figure 7The page shown is the virus detection page. Upload the file to be checked and click the "Confirm Upload" button. The system will check the file and display the test results in a list. Virus detection works by traversing the file using a sliding window, comparing it with signature codes in the computer virus database. If there is an exact match, it is considered a computer virus. If there are no matches, fuzzy matching is performed. If the match threshold is met, it is considered a virus.

[0276] Figure 8 This is the log page, which primarily provides user usage statistics. Users can view information such as the test results, test time, risk level, and virus name of the files they reported. They can filter by test time, test result, and ID to accurately view the records they are looking for. This page supports batch export. Select the records you want to export and click the "Batch Export" button to export the logs to Excel.

[0277] Figure 9 This is the virus database upgrade page. This page is used to upgrade the virus database. Users import training data and test data, select the virus database to be upgraded from the drop-down box, and click "Start Upgrade." Once the upgrade is complete, the results will be displayed in the training results list, along with information such as the ID, virus database name, operation time, and accuracy. The virus database contains not only collected computer virus signatures but also computer virus signatures that have been multiplied and mutated using the clone selection algorithm. The former is used to match known computer viruses, while the latter is used to match computer variants and unknown viruses.

[0278] Figure 10 This is the virus database sharing page, which is primarily used to share virus databases between users. Users can upload their own virus databases or download others' shared virus databases. Select your own virus database and enter the shared name of the virus database in the "Virus Database Name" box. Click "Confirm Upload" to upload your own virus database. The list below displays the virus databases shared by all users. Click "Download" to download other users' virus databases to the system.

[0279] Figure 11 This is the virus database management page. This page allows users to manage the virus database. By entering the upload time, status, and virus database name to filter, the queried virus database will be displayed in the list below. Users can copy, modify, apply, and discard the virus database to manage the virus database.

[0280] The ICSA virus detection model proposed in this invention is compared with four common virus detection models on the Henchiri dataset, mainly comparing the detection capabilities of the five models for known viruses.

[0281] Table 3 Comparative experimental results of Henchiri dataset

[0282]

[0283] Experimental results demonstrate that the ICSA detection model performs exceptionally well in both accuracy and false positive rate, achieving an accuracy rate of 95.13%, the highest among all models. While its false positive rate of 2.47% is slightly higher than the NaiveBayes model's 0.94%, ICSA still holds a significant advantage over models such as SMO, ID3, and J48. The ICSA model not only excels in accurately identifying virus programs but also effectively reduces false positive rates, making it suitable for security-critical applications and demonstrating its strong potential in the field of virus detection.

[0284] In order to analyze the comprehensive performance of each model more intuitively, the experimental results are plotted as scatter plots, such as Figure 12 , the closer to the lower right corner, the better the model performance. As can be seen from the figure, although the NaiveBayes detection model has a low false alarm rate, its accuracy is far lower than other models. Overall, the ICSA detection model is worse than the other four models.

[0285] This model was compared with detection models based on signature scanning and behavioral analysis to verify its ability to detect unknown viruses. By reducing the size of the training set and increasing the size of the test set, the model was simulated to detect unknown viruses, verifying its ability to detect unknown viruses.

[0286] For this experiment, three control experiments were conducted. Each set resampled virus and normal programs from the CILPKU08 dataset to analyze detection rates and false positive rates. The first set used a 4:1 training set and a 1:1 training set to test set, the second set used a 1:1 training set and a 1:4 training set to test set, and the third set used a 1:4 training set and a 2:2 test set. Table 4 shows the specific data splits. Due to the limited data, 20 tests were performed on each of the three sets, and the average of the test results was used as the experimental result. The specific experimental results are shown in Table 5.

[0287] Table 4 Experimental data division

[0288]

[0289] Table 5 Experimental data of CILPKU08 dataset

[0290]

[0291]

[0292] The experimental results show that the virus detection models based on ICSA are superior to those based on behavioral analysis. The virus detection model based on signature scanning has a false positive rate of 0. This is because it uses a one-to-one precise match of signatures, resulting in a false positive rate of 0, but this also results in a very low detection rate.

[0293] In order to analyze the comprehensive performance of each model more intuitively, scatter plots will be drawn for the three groups of control experimental data. Figure 13 、 Figure 14 、 Figure 15 The results of Experiments 1, 2, and 3 are plotted with false alarm rate on the vertical axis and detection rate on the horizontal axis. The closer the scatter plot is to the lower right corner, the higher the model's overall performance. The scatter plot shows that the ICSA-based virus detection model outperforms the other two models in overall performance. This demonstrates that this model not only has superior detection capabilities for known viruses, but also surpasses traditional static detection models in detecting unknown viruses.

[0294] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0295] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A computer virus detection method based on an improved clone selection algorithm, characterized in that: The following steps are involved: Step 1: Use the Halton sequence to initialize the antibody population and set related parameters; Step 2, calculate the fitness value of each antibody; Step 3: Use the fitness-distance balance strategy to select the antibody population; Step 4, cloning the selected antibodies; Step 5, mutating the cloned antibody; In the mutation operation, the higher the contribution of the antibody, the lower the probability of mutation; Step 6, update operation; Select n antibodies with higher contribution from the mutated antibody set as a new excellent antibody set, and then randomly add Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation; Step 7, iteration; Repeat step 2 until the maximum number of iterations G is reached max ; Step 8: Output the optimal feature combination; After the above steps are completed, the optimal feature combination is output to build a virus feature library; Step 9, virus detection; The fitness value of each antibody is calculated, that is, the degree of maliciousness: The specific method for calculating the maliciousness level is as follows: Among them F i For maliciousness, L v is the number of virus programs, L n is the number of normal programs, F v is the total number of features in the virus program, F n is the total number of features in the normal program, For feature i in F v The number of For feature i in F n The number of is the number of virus programs containing feature i, is the number of normal programs containing feature i; The antibody population is selected using the fitness-distance balance strategy: Calculating the distance between each antibody and the current optimal antibody is a key step in evaluating the contribution of antibodies. Specifically, for each antibody, its distance to the current optimal antibody needs to be calculated first. This distance is measured by formula (9). This distance reflects the gap between the position of the antibody in the solution space and the optimal solution. The smaller the distance, the higher the similarity between the antibody and the optimal solution. Next, the contribution of the antibody is calculated using formula (10) This formula combines the fitness value of the antibody and the distance between antibodies; antibodies with higher contribution are selected for cloning operations; in is the contribution of antibodies, is the normalized distance value, P i represents the i-th antibody, X represents the antibody set, is the normalized fitness value, and δ is the balance factor.

2. The computer virus detection method based on the improved clone selection algorithm according to claim 1, characterized in that: The Halton sequence is used to initialize the antibody population and related parameter settings: The feature code is extracted using the N-Gram algorithm to convert the features in the program into a set of hexadecimal bytes. The specific operation is to use the sliding window technology to extract the N-byte sequence in the program to form the feature representation of the program. After encoding the generated feature fragments, the Halton sequence is used to generate the initial population, and the mutation rate, excellent antibody scale and crossover rate parameters are set at the same time.

3. The computer virus detection method based on the improved clone selection algorithm according to claim 1, characterized in that: The selected antibodies were cloned: The number of antibody clones satisfies the following formula: Where a and b are both constants, a>0, and max_clone is the maximum number of clones.

4. The computer virus detection method based on the improved clone selection algorithm according to claim 1, characterized in that: The virus detection: The matching degree calculation formula is as follows, where M is the feature set of the program to be detected, m x is the feature fragment of the program to be detected, T is the virus feature library set, t y It is a feature fragment stored in the virus feature library; M={m1,m2,..,m x }Formula (13) T={t1,t2,..,t y }Formula (14).

5. A virus detection system based on an improved clonal selection algorithm that implements the computer virus detection method based on an improved clonal selection algorithm as claimed in any one of claims 1 to 4, characterized in that: The virus detection system based on the improved clone selection algorithm includes: Initialization module, used to initialize the antibody population and related parameter settings; A calculation module is used to calculate the fitness value of each antibody; Selection module, used for selection operation; A cloning module for cloning the selected antibodies; The mutation module is used to mutate the cloned antibodies. During the mutation operation, the higher the affinity of the antibody, the lower the probability of mutation. The update module is used for update operations; it selects the n antibodies with the highest fitness from the mutated antibody set as the new excellent antibody set, and then randomly adds Nn antibodies to the antibody set, and the population P' is used as the initial population of the next generation; Iteration module, used for iteration; until the maximum number of iterations G is reached max ; Output module, used to output the optimal feature combination; Virus detection module, used for virus detection.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the computer virus detection method based on the improved clone selection algorithm according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor is caused to perform the steps of the computer virus detection method based on the improved clone selection algorithm according to any one of claims 1 to 4.

8. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the virus detection system based on the improved clone selection algorithm as claimed in claim 5.

Images