基于免疫的Windows未知病毒检测方法  

Immun-Based Approach for Detection of Unknown Windows Virus

作　　者：张瑜[1,2] 李涛[1] 吴丽华[1] 夏峰[1] 

机构地区：[1]海南师范大学信息学院,海口571158 [2]四川大学计算机学院,成都610065

出　　处：《电子科技大学学报》2010年第1期80-84,共5页Journal of University of Electronic Science and Technology of China

基　　金：国家自然科学基金(60573130;66873246);国家863计划(2006AA01Z435);教育部博士点基金(20070610032);海南师范大学引进博士科研启动项目(00203020214)的支持

摘　　要：Windows未知病毒令传统反病毒技术疲于应付、防不胜防,且查杀效果不佳。该文借鉴人工免疫思想,在深入剖析Windows PE病毒逻辑结构基础上,提出利用病毒重定位模块作为病毒基因来生成抗体以检测病毒的方法,且建立了自体与非自体、抗原提呈以及抗体生成的动态演化数学模型。实验表明,该方法对于未知WindowsPE病毒的检测率较高,且具有自适应、自学习能力。To effectively detect unknown Windows PE viruses, a novel approach that roots in artificial immune system and uses the self-relocation module to generate antibodies is presented. The logical structure of Windows PE virus is briefly described. The dynamic evolution of self and nonself, the presentation of antigen, and the generation of antibody are proposed. The experiment results indicate that this approach not only has relatively high detection rate of unknown Windows PE virus, but also has better capability of self-adaptive and self-learning.

关 键 词：人工免疫 重定位 未知病毒 病毒基因 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]