摘要
针对现有恶意软件检测方法的不足,提出一种采用免疫原理的恶意软件检测方法。该方法采用程序运行时产生的IRP请求序列作为抗原,定义系统中的正常程序为自体、恶意程序为非自体,通过选定数量的抗体,采用人工免疫原理识别非自体。实验结果表明,此方法在恶意软件的检测方面具有较高的准确率,且误报和漏报率较低。
In order to solve the problems existing in the current malware detection,a new malware detection method based on immune was proposed.In this method,the IRP request sequences created by running programs are regarded as antigen,and the normal programs in operating system are self,malwares are nonself.The nonself will be detected by some antibodies using artificial immunology.Experimental results reveal that this model has high true positive rate,and low false positive and false negative rate.
出处
《计算机科学》
CSCD
北大核心
2010年第9期161-163,217,共4页
Computer Science
基金
国家技术创新基金项目(08C26214411198)
粤港关键领域重点突破项目(2008A011400010)
广州市创新基金项目(2007V41C0301)资助
