摘要
针对恶意软件检测尤其是未知恶意软件检测的不足,提出一种基于免疫原理的恶意软件检测模型,该模型采用程序运行时产生的IRP请求序列作为抗原,定义系统中的正常程序为自体,恶意程序为非自体,通过选定数量的抗体,采用人工免疫原理对非自体进行识别。实验结果表明,此模型在恶意软件的检测方面具有较高的准确率,且误报和漏报率较低,是一种有效的恶意软件检测方法。
In order to solve the problems existing in the current malware detection especially unknown malware detection, this paper proposed a new malware detection model based on immune. In this model, the IRP request sequences created by running programs regarded as antigen, and the normal programs in operating system were self, malwares were nonself. The nonself would be detected by some antibodies using artificial immunology. Experimental results reveal that this model has high true positive rate, and low false positive and false negative rate. It’s an efficient method for malware detection.
出处
《计算机应用研究》
CSCD
北大核心
2010年第6期2313-2315,共3页
Application Research of Computers
基金
国家技术创新基金资助项目(08C26214411198)
粤港关键领域重点突破项目(2008A011400010)
广州市创新基金资助项目(2007V41C0301)
关键词
人工免疫
恶意软件
病毒检测
反病毒
artificial immune
malware
virus detection
anti-virus