检索结果-内蒙古大学图书馆

A malware detection model based on a negative selection algorithm with penalty factor

Science China(Information Sciences) 2010年第12期53卷 2461-2471页

作者： ZHANG PengTao 1,2 , WANG Wei 1,2 & TAN Ying 1,2 1 Department of Machine Intelligence, School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China 2 Key Laboratory of Machine Perception, Ministry of Education, Peking University, Beijing 100871, China 1. Department of Machine Intelligence School of Electronics Engineering and Computer Science Peking University Beijing 100871 China2. Key Laboratory of Machine Perception Ministry of Education Peking University Beijing 100871 China

A malware detection model based on a negative selection algorithm with penalty factor (NSAPF) is proposed in this paper. This model extracts a malware instruction library (MIL), containing instructions that tend to appear in malware, through deep instruction analysis with respect to instruction frequency and file frequency. From the MIL, the proposed model creates a malware candidate signature library (MCSL) and a benign program malware-like signature library (BPMSL) by splitting programs orderly into various short bit strings. Depending on whether a signature matches "self", the NSAPF further divides the MCSL into two malware detection signature libraries (MDSL1 and MDSL2), and uses these as a two-dimensional reference for detecting suspicious programs. The model classifies suspicious programs as malware and benign programs by matching values of the suspicious programs with MDSL1 and MDSL2. Introduction of a penalty factor C in the negative selection algorithm enables this model to overcome the drawback of traditional negative selection algorithms in defining the harmfulness of "self" and "nonself", and focus on the harmfulness of the code, thus greatly improving the effectiveness of the model and also enabling the model to satisfy the different requirements of users in terms of true positive and false positive rates. Experimental results confirm that the proposed model achieves a better true positive rate on completely unknown malware and a better generalization ability while keeping a low false positive rate. The model can balance and adjust the true positive and false positive rates by adjusting the penalty factor C to achieve better performance.

关键词： penalty factor negative selection algorithm signature extraction artificial immune system mal- ware detection

来源：评论

学校读者我要写书评

暂无评论

negative selection algorithm with Variable-Sized r-Contiguous Matching Rule

Negative Selection Algorithm with Variable-Sized r-Contiguou...

引用

The 2010 IEEE International Conference on Progress in Informatics and Computing

作者： Yuebing Chen,Chao Feng,Quan Zhang,Chaojing Tang School of Electronic Science and Technology National University of Defense Technology Changsha Hunan 410073,China

We proposes a negative selection algorithm with variable-sized r-contiguous matching *** value of r can be used to balance between more generalization or more specification.A fixed r reaches a rough *** expect a variable-sized r to reach a refined *** are performed to test the *** to traditional negative selection algorithm and one-class SVM are conducted. The results demonstrate that the new scheme enhances the negative selection algorithm in efficiency for anomaly detection.

关键词： artificial immune system negative selection algorithm r-contiguous matching rule anomaly detection oneclass SVM

来源：评论

学校读者我要写书评

暂无评论

Towards Efficient and Effective negative selection algorithm: A Convex Hull Representation Scheme

Towards Efficient and Effective Negative Selection Algorithm...

引用

8th International Conference of Simulated Evolution and Learning

作者： Majd, Mahshid Shoeleh, Farzaneh Hamzeh, Ali Hashemi, Sattar Shiraz Univ Dept Comp Sci & Engn Shiraz Iran

ISBN: (纸本)9783642172977

negative selection algorithm (NSA) is one of several algorithms inspired by the principles of natural immune system. The algorithm received the researchers attention due to its applicability in various research areas and a number of valuable efforts are made to increase the effectiveness and efficiency of it. The heart of NSA is to somehow find rules called detectors to discriminate self and anomaly areas. Each detector in NSA defines a subspace of problem space where no self data is located. One of the major issues in NSA is detector's shape or representation of detectors which can affect the detection performance significantly. This paper for the first time proposes a new representation for detectors based on convex hull. Since convex hull is a general form of other geometric shapes, it retains the benefits of other shapes meanwhile it provides some new features like the asymmetric shape. Experimental results show a significant enhancement in the accuracy of negative selection algorithm compared to other common representation shapes.

关键词： negative selection algorithm Convex hull Representation Detector Representation

来源：评论

学校读者我要写书评

暂无评论

A hybrid particle swarm optimization and artificial immune system algorithm for image enhancement

引用

SOFT COMPUTING 2015年第8期19卷 2101-2109页

作者： Mahapatra, Prasant Kumar Ganguli, Susmita Kumar, Amod CSIR Cent Sci Instruments Org V Biomed Instrumentat Div 2 Chandigarh 160030 India Tezpur Univ Dept Elect & Commun Tezpur 784028 India

Image enhancement means to improve the perception of information in images. Histogram equalization (HE) and linear contrast stretching (LCS) are the commonly used methods for image enhancement. But images obtained through these processes, generally, have excessive contrast enhancement due to which they are not suitable for use in fields where brightness is of critical importance. In this paper, a hybrid algorithm based on Particle Swarm Optimization (PSO) along with negative selection algorithm, a model of artificial immune system, is proposed for image enhancement which is achieved by enhancing the intensity of the gray levels of the images. The proposed algorithm is applied to histogram equalized images of lathe tool and MATLAB inbuilt images to verify its effectiveness. The results are compared with conventional enhancement techniques such as HE, LCS and Standard PSO algorithm based image enhancement.

关键词： Particle swarm optimization Artificial immune system negative selection algorithm Image enhancement Histogram equalization Linear contrast stretching

来源：评论

学校读者我要写书评

暂无评论

Using IRP with a Novel Artificial Immune algorithm for Windows Malicious Executables Detection

Using IRP with a Novel Artificial Immune Algorithm for Windo...

引用

2016 IEEE International Conference on Progress in Informatics and Computing

作者： Fuyong Zhang Ying Ma School of Computer Science and Network Security Dongguan University of Technology School of Computer and Information Engineering Xiamen University of Technology

Run-time malware detection strategies have already attracted extensive attention due to its effectiveness and robustness. With regards to Windows operating system, the API（Application Program Interface） is chosen to analyze program behavior. However, the API call sequences can be manipulated by a crafty attacker to circumvent detection. In order to handle this problem, we present a novel run-time malware detection strategy based on IRP（I/O Request Package） and develop a tool for capturing IRPs based on kernel driver technology. Some classic approaches are exploited to classify IRP sequences for malware detection, including Na?ve Bayes, Bayesian Networks,Support Vector Machine, C4.5 Decision Tree, Boosting, and negative selection algorithm. For fast run-time malware detection, we also present a novel artificial immune algorithm（NAIA） by means of short IRP sequences which exist only in malicious IRP sequences. Ultimately, for the whole dataset, boosted decision tree outperforms others with true positive rate 98.3%, and our NAIA outperforms other methods for the first 200 IRPs of each sequence.

关键词： I/O Request Package artificial immune system negative selection algorithm data mining malware detection

来源：评论

学校读者我要写书评

暂无评论

A hybrid approach for efficient anomaly detection using metaheuristic methods

引用

JOURNAL OF ADVANCED RESEARCH 2015年第4期6卷 609-619页

作者： Ghanem, Tamer F. Elkilani, Wail S. Abdul-kader, Hatem M. Menofiya Univ Fac Comp & Informat Dept Informat Technol Shibin Al Kawm Menofiya Egypt Ain Shams Univ Fac Comp & Informat Dept Comp Syst Cairo Egypt Menofiya Univ Fac Comp & Informat Dept Informat Syst Shibin Al Kawm Menofiya Egypt

Network intrusion detection based on anomaly detection techniques has a significant role in protecting networks and systems against harmful activities. Different metaheuristic techniques have been used for anomaly detector generation. Yet, reported literature has not studied the use of the multi-start metaheuristic method for detector generation. This paper proposes a hybrid approach for anomaly detection in large scale datasets using detectors generated based on multi-start metaheuristic method and genetic algorithms. The proposed approach has taken some inspiration of negative selection-based detector generation. The evaluation of this approach is performed using NSL-KDD dataset which is a modified version of the widely used KDD CUP 99 dataset. The results show its effectiveness in generating a suitable number of detectors with an accuracy of 96.1% compared to other competitors of machine learning algorithms. (C) 2014 Production and hosting by Elsevier B.V. on behalf of Cairo University.

关键词： Intrusion detection Anomaly detection negative selection algorithm Multi-start methods Genetic algorithms

来源：评论

学校读者我要写书评

暂无评论

Application of an Information Fusion Method to Compound Fault Diagnosis of Rotating Machinery 27

Application of an Information Fusion Method to Compound Faul...

引用

27th Chinese Control and Decision Conference (CCDC)

作者： Hu, Qin Qin, Aisong Zhang, Qinghua Sun, Guoxi Shao, Longqiu Guangdong Univ Petrochem Technol Guangdong Prov Key Lab Petrochem Equipment Fault Maoming 525000 Peoples R China

ISBN: (纸本)9781479970162

Aiming at how to use the multiple fault features information synthetically to improve accuracy of compound fault diagnosis, an information fusion method based on the weighted evidence theory was proposed to effectively diagnose compound faults of rotating machinery. Firstly multiple fault-features were extracted by the genetic programming. Each fault feature was separately used to act as evidence and the initial diagnosis accuracy was regarded as the weight coefficient of the evidence. Then through the negative selection algorithm, the diagnosis ability of the local diagnosis was advanced and an impersonal means of obtaining basic probability assignment was given. Finally the fusion result was obtained by utilizing the weighted evidence theory into the decision-making information fusion for the preliminary result. By comparing the diagnosis results with other artificial intelligence algorithm, experiment result indicates that using multiple weighted evidences fusion can improve the diagnostic accuracy of compound fault.

关键词： Genetic programming negative selection algorithm Weighted evidence theory Fusion decision

来源：评论

学校读者我要写书评

暂无评论

Application of an Information Fusion Method to Compound Fault Diagnosis of Rotating Machinery

Application of an Information Fusion Method to Compound Faul...

引用

第27届中国控制与决策会议

作者： Qin Hu Aisong Qin Qinghua Zhang Guoxi Sun Longqiu Shao Guangdong provincial Key Laboratory of Petrochemical Equipment Fault Diagnosis Guangdong University of Petrochemical Technology

ISBN: (纸本)9781479970186

Aiming at how to use the multiple fault features information synthetically to improve accuracy of compound fault diagnosis,an information fusion method based on the weighted evidence theory was proposed to effectively diagnose compound faults of rotating *** multiple fault features were extracted by the genetic *** fault feature was separately used to act as evidence and the initial diagnosis accuracy was regarded as the weight coefficient of the *** through the negative selection algorithm,the diagnosis ability of the local diagnosis was advanced and an impersonal means of obtaining basic probability assignment was *** the fusion result was obtained by utilizing the weighted evidence theory into the decision-making information fusion for the preliminary *** comparing the diagnosis results with other artificial intelligence algorithm,experiment result indicates that using multiple weighted evidences fusion can improve the diagnostic accuracy of compound fault.

关键词： Genetic programming negative selection algorithm Weighted evidence theory Fusion decision

来源：评论

学校读者我要写书评

暂无评论

A self-adaptive negative selection algorithm used for anomaly detection

引用

Progress in Natural Science:Materials International 2009年第2期19卷 261-266页

作者： Jinquan Zeng,Xiaojie Liu,Tao Li,Caiming Liu,Lingxi Peng,Feixian Sun Department of Computer Science,Sichuan University,Chengdu 610065,China [a]Department of Computer Science Sichuan University Chengdu 610065 China

A novel negative selection algorithm (NSA),which is referred to as ANSA,is presented. In many actual anomaly detection systems,the training data are just partially composed of the normal elements,and the self/nonself space often varies over time. Therefore,anom-aly detection system has to build the profile of the system based on a part of self elements and adjust itself to adapt those variables. However,previous NSAs need a large number of self elements to build the profile of the system,and lack adaptability. In order to over-come these limitations,the proposed approach uses a novel technique to adjust the self radius and evolve the nonself-covering detectors to build an appropriate profile of the system. To determine the performance of the approach,the experiments with the well-known data-set were performed. Results exhibited that our proposed approach outperforms the previous techniques.

关键词： Artificial immune system Anomaly detection negative selection algorithm

来源：评论

学校读者我要写书评

暂无评论

Re-editing and Censoring of Detectors in negative selection algorithm

引用

INTERNATIONAL JOURNAL OF COMPUTATIONAL INTELLIGENCE SYSTEMS 2009年第3期2卷 298-311页

作者： Gao, X. Z. Ovaska, S. J. Wang, X. Aalto Univ Dept Elect Engn FI-02150 Espoo Finland

The negative selection algorithm (NSA) is a kind of novelty detection method inspired by the biological self/nonself discrimination principles. In this paper, we propose two new schemes for the detectors re-editing and censoring in the NSA. The detectors that fail to pass the negative selection phase are re-edited and updated to become qualified using the Differential Evolution (DE) method. In the detectors censoring, the qualification of all the detectors is evaluated, and only those appropriate ones are retained. Prior knowledge of the anomalous data is utilized to discriminate the detectors so that their anomaly detection performances can be improved. The effectiveness of our detectors re-editing and censoring approaches is examined with both artificial signals and a practical bearings fault detection problem.

关键词： artificial immune systems negative selection algorithm differential evolution anomaly detection fault detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：