基于MHC的恶意代码检测方法.pdfVIP

基于MHC 的恶意代码检测方法 1, 2 2 1 2 2 张　瑜 , 　李　涛, 　吴丽华 　覃仁超, 　赵　奎 ( 1. , 57 1158; 2. , 610065) : 受生物免疫系统中主要组织相容性复合体 ( ) 子特性的启 M HC major histocompatibility comple 发, 提出了一种基于M HC 的恶意代码检测方法M CDM HC。对抗体( 检测器) 恒定区和可变区 别进行编码, 恒定区由M HC 代码组成且保持相对稳定, 这有利于保存优秀抗体基因; 可变区的代码在疫苗的作用下有导 向的变异, 来快速获得多样性抗体以检测未知恶意代码。且建立了自体与非自体、抗原提呈以及抗体生成的 动态演化方程。通过恶意代码检测对比实验表明, 该方法对于恶意代码的检测率优于典型的基于免疫的 AISCSA 方法。 : 恶意代码; 人工免疫系统; 主要组织相容性复合体; 抗体 : T P393 : A: 1009-3443( 2009) 04-0344-06 - MHC inspired approach for malicious code detection 1, 2, 2, - 1, - 2 , 2 ZHA N G Yu LI Tao W U L i hua QIN Ren chao ZHA O K ui ( 1. College of Information Science and T echnology , Hainan Normal University , Haikou 57 1158, China; 2. , , 610065, ) College of Computer Science Sichuan U niversity Chengdu China Abstract: By dr aw ing inspir ation fr om the features of major histocompatibility conphe ( M HC) in the biological immune system , an MHC-inspir ed approach of malicious code detection w as proposed. T he antibody ( detector) consisted of the constant region and the variable region. T he constant region filled w ith MHC strings w as to preserve outstanding antibody genes. The var iable region composed of other , . antibodies genes fragments was to improve the antibody diver sity by mutation T he dynamic evolution of self and nonself , the presentation of antigen and the generation of antibody w ere discussed. E periments w er e conducted on 100 malicious codes fr om the w i