## 4 Performance Evaluation
### Experimental Results  
The data in Table 2 must be converted to binary form. We take 64 characters as the antibody length, which makes it easy for the program to extract _self_ and _nonself_. This standardized data format is shown in Figure 7.  
The detection rate is  
\[\text{TP}=\frac{T\_count}{Attack\_count} \tag{18}\]  
where \(T\_count\) is the number of abnormal nodes detected, and \(Attack\_count\) is the number of system attack records entered. The abnormal-detection rate is  
\[\text{FP}=\frac{F\_count}{Normal\_count} \tag{19}\] \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter Type** & **Parameters** & **Value** \\ \hline \multirow{3}{*}{Immune parameter} & L (Size of a single detector) & 64 bit \\  & r (Threshold of matches) & 16 bit \\  & m (Number of alphabet symbols) & 4 \\  & P (Number of detectors) & 200 \\ \multirow{3}{*}{Game parameter} & A (Probability that node will be infected and detected) & 0.8 \\  & \(\beta\) (Probability that node is not infected but is detected) & 0.08 \\  & Pr (Probability that user will check alarm node) & 0.8 \\  & \(\varnothing\) (User detects failed node and recovers, allowing user to \\  & reduce percentage of losses) & 0.5 \\ \multirow{3}{*}{G\({}_{\text{A}}\) (Benefits that can be gained when user \\  & detects an attack).} & 250 \\ \multirow{3}{*}{G\({}_{\text{C}}\) (Benefits of normal node communication.)} & 100 \\  & \(\text{G\({}_{\text{D}}\) (Average return per test)}\) & 200 \\ \multirow{3}{*}{E\({}_{\text{D}}\) (Average cost per test)} & 10 \\  & D (Node attack was not detected and user lost.) & 1000 \\ \multirow{3}{*}{L\({}_{\text{F}}\) (Normal node was mistakenly alarmed and user lost)} & 15 \\  & \(\lambda\) (Environmental weight; starts when number of node \\  & failures exceeds threshold) & 0.8 \\ \multirow{3}{*}{\(\delta_{k}\) (Probability that abnormal detection agent chooses to \\  & perform detection action)} & 0.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Values of immune game model parameters. Figure 7: Standardized data format. where \(F\_count\) is the number of normal nodes which are considered as abnormal, _Normal_count_ is the number of nodes that have legitimate behavior. So, TP indicates true positive and FP means false positive. The simulation experiment had training and test parts. The training part selects several records that can fully reflect various attack types from 10% of the training subset of the _KDD-CUP99_ dataset. They are processed and loaded into the system. The system is trained to produce an initial set of _self_. In the test part, several records were selected from the test subset of the _KDD-CUP99_ dataset to fully reflect the various attack types, and attack behavior was reproduced through the network reissue tool, so as to verify the detection and error-detection rates. The immune-game algorithm, Extended-DynamiCS, and LISYS based on the AIS model were experimentally compared, with detection and abnormal-detection rates as shown in Figure 8. The detection rate and false detection rate of the proposed algorithm are significantly better than those of the other two algorithms. This is due to the adoption of vaccine and niching strategy in the immune detection part of the algorithm in this paper. Vaccines have made testing more efficient. Niching strategy increases the detection coverage, and thus further improves the detection efficiency and reduces the false detection rate. Figure 8: Contrast of FP and TP. Figure 9 shows the stabilization time of the network under different numbers of nodes. The proposed algorithm considers not only the energy consumption of nodes but the influence of links on node security. The other two algorithms take insufficient account of the link factors and do not optimize the initial process of the network region. Therefore, their network operation stability is lower than that of the algorithm presented in this paper. Figure 9 also shows that the stabilization time decreases with more nodes.