一种采用免疫原理的恶意软件检测方法

Immune-based Method for Malware Detection

针对现有恶意软件检测方法的不足,提出一种采用免疫原理的恶意软件检测方法。该方法采用程序运行时产生的IRP请求序列作为抗原,定义系统中的正常程序为自体、恶意程序为非自体,通过选定数量的抗体,采用人工免疫原理识别非自体。实验结果表明,此方法在恶意软件的检测方面具有较高的准确率,且误报和漏报率较低。

In order to solve the problems existing in the current malware detection,a new malware detection method based on immune was proposed.In this method,the IRP request sequences created by running programs are regarded as antigen,and the normal programs in operating system are self,malwares are nonself.The nonself will be detected by some antibodies using artificial immunology.Experimental results reveal that this model has high true positive rate,and low false positive and false negative rate.