## 3 Immune Game-Based Abnormal Node Detection Algorithm
### Detailed System Model and Problem Formulation
#### 3.2.1 Immune Detection Algorithm
\(\bullet\) **Establishment of dangerous areas**  
According to the niching strategy of biological immunity, a node is randomly identified, and the Euclidean distance from the characteristic vector of the state of other nodes is calculated. We set a small habitat threshold, and if the Euclidean distance between two nodes does not exceed the threshold, the node state is considered similar. As long as the number of nodes in the same state exceeds half the total number of nodes, such nodes are considered normal. The remaining nodes are identified as hazardous sources. The mapping relation is shown in Figure 4.  
\(\bullet\) **Fitness function**  
The fitness function between \(Ag_{i}\) and \(Ab_{j}\) is  
\[\text{Aff}_{i,j}=\frac{1}{\|Ab_{i}-Ag_{j}\|}\ (i=1,2,\cdots,N) \tag{9}\]  
\(\bullet\) **Niching strategy**  
The niching strategy is to divide individuals with the same or similar adaptability. The vaccine selects only some excellent individuals and discards the rest, thus avoiding the system falling into local optimality. \(\bullet\) **Immune operation**  
(1) Negative selection  
The system extracts self-information called _self_ from feature information and sets matching schemes and parameters. Information that does not match the _self_ is collectively called _nonself_. Abnormal detection is done by differentiating between _self_ and _nonself_. (2) Clone, crossover, and mutation. In biological immunity, individuals with high adaptability will be cloned as excellent genes involved in the identification of antigens. In artificial immunity, individuals with high adaptability are involved in crossovers and mutations to preserve excellent genes. Intersections  
Figure 4: Mapping relation of antibody library. are performed between two individuals, with random intersections selected for fragment exchange. Mutation is the reverse substitution of randomly selected gene points. * **Basic idea of the algorithm** The feature information of nodes is extracted as the measured data, and random binary data are taken as the initial population to conduct antibody training. According to the set threshold value and fitness function, a _self-tonself_ operation is carried out to calculate individual fitness. According to the fitness, the corresponding string is selected for immune operation to obtain the antibody library. Antibodies in the antibody library generate vaccines through niche strategies. The vaccine responds directly to the failure node in the subsequent test. The antibody library is constantly updated in the detection process, and the vaccine is generated and replaced to form a dynamic detection mechanism. * **Basic steps and flowchart of the algorithm** The flowchart of the abnormal detection algorithm based on immunity is shown in Figure 5.  
Step 1: Initialization parameters This includes node data extraction and binary encoding. In the mobile network, the node detection area is selected. The node characteristic information can be obtained from the node key file. After the information is obtained, the data must be binary encoded. Step 2: Obtain the initial population A randomly coded antibody library is established. The fitness function is imputed. Negative selection and clone selection are used to respond to node characteristic data. Thus, the initial population is obtained. Figure 5: Flowchart of immune algorithm. Step 3: Establishment of antibody library  
The individual fitness is calculated, the antibody obtained by matching with the threshold, and the qualified antibody library generated. The niche strategy starts at any time in the antibody library to eliminate antibodies that are too similar. The antibody library is updated dynamically. Step 4: Vaccine mechanism  
Detected antibodies that exceed the vaccine threshold are added to the antibody library as vaccines. Step 5: Matching detection  
Antibodies in the antibody library will start detection as required, calculate the Euclidean distance \(d_{ij}\) of the state feature vector between nodes \(i\) and \(j\), and mark node \(i\) to trigger a danger signal.