Information Technology Reference
In-Depth Information
In all experiments, the size of the test set is denoted by N . Notably, the test set con-
sists of different anomaly strings, and they are generated randomly one by one. That is
to say, if an anomaly string is identical to any one of the test set, it can not be added into
the test set. In these two algorithms, the self set and test set are generated randomly by
randomize(…) and random(…) functions in visual c++. Suppose the length of string is
l . An anomaly string in the test set is generated according to the following steps.
l
(1) The random(…) function is used to generate an integer between 0 and
2
1
directly, then transform this integer into a binary string.
(2) If this binary string matches any self individual or any one in the test set, go to
(1). Or add this binary string into the test set.
In addition, when the length of string is l and the matching length is r , a self
l
string with Hamming distance can cover
strings. Therefore, in the following
r
experiments, the size of self set is relatively small. Otherwise, the self set is prone to
covering the whole space, and both the detector set and the test set are difficult to be
generated.
In the experiments,
G
represents the matching times between all candidate de-
M
G
M
tectors and the self individuals during the generation of detectors.
C
=
repre-
G
N
N
R
S
sents the average cost of generating one matured detector. And this parameter can
reflect the algorithms' time cost experimentally. Finally,
D
represents the detection
R
rate. And
D
=
1
P
.
R
f
4.1 Comparisons on
G
and
D
Between h-NSA and t-NSA
M
R
Experiment 1. The size of self set
N
is fixed and the size of the detector set
N
S
R
varies. Set
l
=
16
,
r
=
14
,
N
=
300
,
N
=
10000
. And the experimental results are
S
T
2
0.14
1.8
0.12
1.6
h-NSA
t-NSA
1.4
0.1
1.2
0.08
1
0.06
0.8
0.6
h-NSA
t-NSA
0.04
0.4
0.02
0.2
0
0
50
100
150
200
250
300
350
400
450
500
50
100
150
200
250
300
350
400
450
500
(a)
(b)
C
N
Fig. 3. (a) Comparisons on
between h-NSA and t-NSA when fixing
and varying
S
N
C
N
; (b) Standard deviation of
between h-NSA and t-NSA when fixing
and varying
R
S
N
R
 
Search WWH ::




Custom Search