Please wait a minute...
FITEE
Front. Inform. Technol. Electron. Eng.  2011, Vol. 12 Issue (6): 443-454    DOI: 10.1631/jzus.C1000445
    
An immune local concentration based virus detection approach
Wei Wang1,2, Peng-tao Zhang1,2, Ying Tan*,1,2, Xin-gui He1,2
1 MOE Key Laboratory of Machine Perception, Peking University, Beijing 100871, China 2 Department of Machine Intelligence, School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China
An immune local concentration based virus detection approach
Wei Wang1,2, Peng-tao Zhang1,2, Ying Tan*,1,2, Xin-gui He1,2
1 MOE Key Laboratory of Machine Perception, Peking University, Beijing 100871, China 2 Department of Machine Intelligence, School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China
 全文: PDF(636 KB)  
摘要： Along with the evolution of computer viruses, the number of file samples that need to be analyzed has constantly increased. An automatic and robust tool is needed to classify the file samples quickly and efficiently. Inspired by the human immune system, we developed a local concentration based virus detection method, which connects a certain number of two-element local concentration vectors as a feature vector. In contrast to the existing data mining techniques, the new method does not remember exact file content for virus detection, but uses a non-signature paradigm, such that it can detect some previously unknown viruses and overcome the techniques like obfuscation to bypass signatures. This model first extracts the viral tendency of each fragment and identifies a set of statical structural detectors, and then uses an information-theoretic preprocessing to remove redundancy in the detectors’ set to generate ‘self’ and ‘nonself’ detector libraries. Finally, ‘self’ and ‘nonself’ local concentrations are constructed by using the libraries, to form a vector with an array of two elements of local concentrations for detecting viruses efficiently. Several standard data mining classifiers, including K-nearest neighbor (KNN), radial basis function (RBF) neural networks, and support vector machine (SVM), are leveraged to classify the local concentration vector as the feature of a benign or malicious program and to verify the effectiveness and robustness of this approach. Experimental results show that the proposed approach not only has a much faster speed, but also gives around 98% of accuracy.
关键词： Local concentration;  Artificial immune system;  Virus detection    
Abstract: Along with the evolution of computer viruses, the number of file samples that need to be analyzed has constantly increased. An automatic and robust tool is needed to classify the file samples quickly and efficiently. Inspired by the human immune system, we developed a local concentration based virus detection method, which connects a certain number of two-element local concentration vectors as a feature vector. In contrast to the existing data mining techniques, the new method does not remember exact file content for virus detection, but uses a non-signature paradigm, such that it can detect some previously unknown viruses and overcome the techniques like obfuscation to bypass signatures. This model first extracts the viral tendency of each fragment and identifies a set of statical structural detectors, and then uses an information-theoretic preprocessing to remove redundancy in the detectors’ set to generate ‘self’ and ‘nonself’ detector libraries. Finally, ‘self’ and ‘nonself’ local concentrations are constructed by using the libraries, to form a vector with an array of two elements of local concentrations for detecting viruses efficiently. Several standard data mining classifiers, including K-nearest neighbor (KNN), radial basis function (RBF) neural networks, and support vector machine (SVM), are leveraged to classify the local concentration vector as the feature of a benign or malicious program and to verify the effectiveness and robustness of this approach. Experimental results show that the proposed approach not only has a much faster speed, but also gives around 98% of accuracy.
Key words: Local concentration    Artificial immune system    Virus detection
收稿日期: 2010-12-28 出版日期: 2011-06-07
CLC:  TP301  
服务　　
把本文推荐给朋友
加入引用管理器
E-mail Alert
RSS
作者相关文章　　
Wei Wang
Peng-tao Zhang
Ying Tan
Xin-gui He

引用本文:

Wei Wang, Peng-tao Zhang, Ying Tan, Xin-gui He. An immune local concentration based virus detection approach. Front. Inform. Technol. Electron. Eng., 2011, 12(6): 443-454.

链接本文:

http://www.zjujournals.com/xueshu/fitee/CN/10.1631/jzus.C1000445    或    http://www.zjujournals.com/xueshu/fitee/CN/Y2011/V12/I6/443

[1] Qing-zheng Xu, Lei Wang. Recent advances in the artificial endocrine system[J]. Front. Inform. Technol. Electron. Eng., 2011, 12(3): 171-183.