| Input: |
| The traffic data instance collected on one day (m is the number of user subprofiles; n is |
| the number of instances in the user subprofile into which can be classified.); |
| Output: |
| The answer to the question: “Is this terminal infected with virus?”; |
| (1) for i = 1 to m do |
| (2) Calculate the Similarity degree sim(, class(i)) between and user subprofile i; |
| (3) for i = 1 to m do |
| (4) Find the maximum value MaxClassSim among all sim(, class(i)) and the |
| corresponding class class(x) that yields MaxClassSim; |
| (5) for j = 1 to n do |
| (6) Calculate the similarity degree sim(,) between and the jth instance in class x; |
| (7) for j = 1 to n do |
| (8) Find the minimum value MinSim and the maximum value MinSim among all sim(,); |
| (9) if MinSim > a&&MaxSim > b then (a, b are predetermined thresholds.) |
| (10) Update subprofile x by including into it; |
| (11) return there’s no virus; |
| (12) else |
| (13) return the terminal is infected with virus; |
| (14) end if |