Input:
The traffic data instance collected on one day (m is the number of user subprofiles; n is
the number of instances in the user subprofile into which can be classified.);
Output:
The answer to the question: “Is this terminal infected with virus?”;
(1) for i = 1 to m do
(2)  Calculate the Similarity degree sim( , class(i)) between and user subprofile i;
(3) for  i = 1 to m do
(4)  Find the maximum value MaxClassSim among all sim( , class(i)) and the
corresponding class class(x) that yields MaxClassSim;
(5) for  j = 1 to n do
(6)  Calculate the similarity degree sim( , ) between and the jth instance in class x;
(7) for j = 1 to n do
(8)  Find the minimum value MinSim and the maximum value MinSim among all sim( , );
(9) if MinSim > a&&MaxSim > b then (a, b are predetermined thresholds.)
(10) Update subprofile x by including into it;
(11) return there’s no virus;
(12)else
(13)  return the terminal is infected with virus;
(14)end if
Algorithm 1: Virus detection algorithm.