论文部分内容阅读
针对目前木马病毒种类多、检测难度大、隐蔽功能强等难点,在研究Windows系统下木马程序特点以及生物免疫机制的基础上,考虑到人体免疫机制与木马检测机制的相似性,提出一种基于免疫的木马检测方法,设计了基于免疫的木马检测模型,提出了改进的否定选择算法中的检测器产生算法EV-Detector,并将其用于木马检测.实验结果表明,相比同类方法,基于EV-Detector的否定选择算法EVD-NSA在检测木马方面有着较高的检测率与较低的误报率,能够有效地检测出Windows系统下新颖未知木马程序.
In view of the current Trojan virus variety, the difficulty of detection, concealment and other difficult, based on the study of the characteristics of Windows Trojan programs and biological immune mechanism, taking into account the similarities between human immune mechanism and Trojan detection mechanism, Immune Trojan detection method, a immune-based Trojan detection model is designed, and an improved negative selection algorithm detector production algorithm EV-Detector is proposed and used for Trojan detection.The experimental results show that compared with similar methods, EV-Detector negative selection algorithm EVD-NSA in the detection of Trojans have a higher detection rate and lower false alarm rate, can effectively detect the Windows system, a new unknown Trojan program.