【摘要】 针对目前木马病毒种类多、检测难度大、隐蔽功能强等难点,在研究Windows系统下木马程序特点以及生物免疫机制的基础上,考虑到人体免疫机制与木马检测机制的相似性,提出一种基于免疫的木马检测方法,设计了基于免疫的木马检测模型,提出了改进的否定选择算法中的检测器产生算法EV-Detector,并将其用于木马检测.实验结果表明,相比同类方法,基于EV-Detector的否定选择算法EVD-NSA在检测木马方面有着较高的检测率与较低的误报率,能够有效地检测出Windows系统下新颖未知木马程序.更多还原

【Abstract】 Nowadays Trojan and virus programs have a large number,are difficult to detect,and also have hidden features.Based on the study of the biological immune mechanism and Trojans on the Windows operating system,according to the similarity between the detection mechanism of Trojan horses and the body’s immune mechanism,we propose a method of immune-inspired Trojan detection,design a model of immune-inspired Trojan detection,propose a improved detector generation algorithm called EV-Detector,and make a large number of experiments on the Windows operating system.The experimental results show that EVD-NSA which based on improved detector generation algorithm EV-Detector in the detection of Trojan horses has a higher detection rate and low false alarm rate compared with common methods,the detection method can effectively detect the novel unknown Trojan horses on the Windows operating system.更多还原