基于免疫原理的恶意软件检测模型  

Immune-based model for malware detection

作　　者：张福勇[1] 齐德昱[1] 胡镜林[1] 

机构地区：[1]华南理工大学计算机系统研究所,广州510640

出　　处：《计算机应用研究》2010年第6期2313-2315,共3页Application Research of Computers

基　　金：国家技术创新基金资助项目(08C26214411198);粤港关键领域重点突破项目(2008A011400010);广州市创新基金资助项目(2007V41C0301)

摘　　要：针对恶意软件检测尤其是未知恶意软件检测的不足,提出一种基于免疫原理的恶意软件检测模型,该模型采用程序运行时产生的IRP请求序列作为抗原,定义系统中的正常程序为自体,恶意程序为非自体,通过选定数量的抗体,采用人工免疫原理对非自体进行识别。实验结果表明,此模型在恶意软件的检测方面具有较高的准确率,且误报和漏报率较低,是一种有效的恶意软件检测方法。In order to solve the problems existing in the current malware detection especially unknown malware detection, this paper proposed a new malware detection model based on immune. In this model, the IRP request sequences created by running programs regarded as antigen, and the normal programs in operating system were self, malwares were nonself. The nonself would be detected by some antibodies using artificial immunology. Experimental results reveal that this model has high true positive rate, and low false positive and false negative rate. It’s an efficient method for malware detection.

关 键 词：人工免疫 恶意软件 病毒检测 反病毒 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]