**Input:** |

* *The traffic data instance collected on one day (*m* is the number of user subprofiles; *n* is |

the number of instances in the user subprofile into which can be classified.); |

**Output:** |

* *The answer to the question: “Is this terminal infected with virus?”; |

(1) * ***for *** i* = 1 to *m ***do** |

(2) * * Calculate the Similarity degree sim(, class(*i*)) between and user subprofile *i*; |

(3) * ***for** *i* = 1 to *m ***do** |

(4) * *Find the maximum value *MaxClassSim* among all sim(, class(*i*)) and the |

* *corresponding class class(*x*) that yields *MaxClassSim*; |

(5) * ***for** *j* = 1 to *n ***do** |

(6) * *Calculate the similarity degree sim(,) between and the *j*th instance in class *x*; |

(7) * ***for *** j* = 1 to *n ***do** |

(8) * *Find the minimum value *MinSim* and the maximum value *MinSim* among all sim(,); |

(9) * ***if *** **MinSim* > *a*&&*MaxSim* > *b ***then** (*a*, *b* are predetermined thresholds.) |

(10) * *Update subprofile *x* by including into it; |

(11) * ***return** there’s no virus; |

(12)* ***else** |

(13) * ***return **the terminal is infected with virus; |

(14)* ***end if** |