Abstract:

 A matching algorithm based on the negative selection for anomaly detection was presented in this paper. In the algorithm the effects of position between two temporal sequence to matching degree were considered. So it could distinguish accurately self and non-self, and reduced the size of detective set effectively. Using normal sequence calls, the initial detective set was created, and the detective set was extended by learning, according to the proportion of anomaly temporal sequence to judge whether this sequence was anomaly. Finally, the results of experiment was given.

Key words: anomaly detection, negative selection algorithm, sequence matching

摘要：

使用了一种改进的否定选择匹配算法来检测异常行为。在这种算法中考虑了位置因素对两个序列匹配度的影响,从而能够更加准确识别自体与非自体,有效地减小检测集的规模。首先使用正常的序列调用生成初始检测集,然后通过学习来扩充检测集,使用最终得到的检测集扫描一定长度的调用序列,通过其中异常序列的比例来显示该段序列调用是否出现了异常。最后给出了实验结果。

关键词:  异常检测, 否定选择算法, 序列匹配