A Synthetic Reverse Model Based on AIS and the Application - Advances in Computational Science and Engineering - page 254

∵ | AE | <| BF |,

∴ fp (P) < fp (Q) .

That is to say the abnormal probability of point P is less than that of point Q.

4.2 Synthetic Distance Model

The two above conclusions in figure (a) and figure (b) are inconsistent. In order to
achieve coincidence of the result of the judgement, we make,

| AE |

fp ( P ) =

| AE | + | AC |

| BF |

fp ( Q ) =

| BF | + | BD |

Considering both the distance from "normal Plane" and the distance from "abnormal
plane", we give a synthetic model shown in Figure 6.

z

P

x

o

E

C

A

Q

F

y

D

B

Fig. 6. The synthetic distance model of behavior vector

4.3 Synthetic Dimension Reduction Model

In accordance with the model proposed in above sections, we defined the normal de-
gree, abnormal degree, the intrusion probability of a network behavior vector X as
following.