Self-Nonself Discrimination in a Computer
SP '94 Proceedings of the 1994 IEEE Symposium on Security and Privacy
An artificial immune system architecture for computer securityapplications
IEEE Transactions on Evolutionary Computation
Hybrid email spam detection model with negative selection algorithm and differential evolution
Engineering Applications of Artificial Intelligence
| Hi-index | 0.00 |
More and more unknown malware that hide itself in the operating system kernel make the traditional antivirus difficult to detect. Inspired by the biological immune system, we proposed a novel immunity-inspired model for malware detection---IMD. The IMD model extracts the I/O Request Packets (IRPs) sequence produced by the process running in kernel mode as antigen, defines the normal benign programs as self programs, and defines the malwares as nonself programs. By the process behavior monitoring and the family gene analysis, the model can monitor the evolution of malware. The model generates the immature antibodies by vaccination, produces mature antibodies by clonal selection and gene evolution, and then learns and evolutionary identifies the unknown malware by the mature antibodies. Experiments show that the proposed model for unknown malware detection has high detection rate, low falsepositive rate, and low omission rate.