Abstract:Along with the evolution of computer viruses, the number of file samples that need to be analyzed has constantly increased. An automatic and robust tool is needed to classify the file samples quickly and efficiently. Inspired by the human immune system, we developed a local concentration based virus detection method, which connects a certain number of two-element local concentration vectors as a feature vector. In contrast to the existing data mining techniques, the new method does not remember exact file content for virus detection, but uses a non-signature paradigm, such that it can detect some previously unknown viruses and overcome the techniques like obfuscation to bypass signatures. This model first extracts the viral tendency of each fragment and identifies a set of statical structural detectors, and then uses an information-theoretic preprocessing to remove redundancy in the detectors’ set to generate ‘self’ and ‘nonself’ detector libraries. Finally, ‘self’ and ‘nonself’ local concentrations are constructed by using the libraries, to form a vector with an array of two elements of local concentrations for detecting viruses efficiently. Several standard data mining classifiers, including K-nearest neighbor (KNN), radial basis function (RBF) neural networks, and support vector machine (SVM), are leveraged to classify the local concentration vector as the feature of a benign or malicious program and to verify the effectiveness and robustness of this approach. Experimental results show that the proposed approach not only has a much faster speed, but also gives around 98% of accuracy.

Signature Extraction and Detection Method of Computer Viruses Based on Immunity and Code Relocation

A Feature Extraction Method of Computer Viruses Based on Artificial Immune and Code Relevance

Host Based Unknown WOrm Detection Using Machine Learning

Method Of Dynamic Script-Virus Detection Based On Immunology

A virus detection model based on immunology and SVDD

Study Defense Mechanism of Computer Virus in Lab

Research on Immune Recognition Model and Algorithm for Unknown Viruses Detection

Study on Virus Signatures based on Matching in Virus-detecting Technologies

A Hierarchical Artificial Immune Model for Virus Detection

Animmune Local Concentration Based Virus Detection Approach

Unknown malicious executables detection based on immune principles

Novel Virus Active Defense Technique and Detection Algorithm

Worm Detection and Signature Extraction Based on Communication Characteristics

Research of Trojan Detection System Based on Artificial Immune

Research of Anti-Anti-Virus and Anti-Virus Technology under New Situation

The Algorithm Design of Agent for Detecting and Analyzing Data in Intrusion Detection Based on Immune Principle

An NN-Based Malicious Executables Detection Algorithm Based on Immune Principles

Large Scale Network Worm Detection Using Automatic Signature Extraction

Intrusion Immune Recognition Method Based on Affinity Mutation Mechanism

Survey on Malicious Code Intelligent Detection Techniques

On computer viral infection and the effect of immunization