Spyware self-adaptation induction and detection method based on artificial immunity

Abstract

The invention introduce the principle that the natural killer (NK) in a human immune system induces a latent virus into an artificial immune system (AIS) and provides an artificial immune method based on artificial NK cells for self-adaptively discovering latent spyware. In the system, artificial NK can self-adaptively discover traces of the unknown spyware through learning and evolution, release some 'baits (induction factors)' which interests the spyware and induces the spyware to perform malice activities. The immune system can finally identify the spyware by sensing and relating the activated malice activities, so that detection rate of the spyware is increased. By the method, known and unknown spyware can be discovered, and good detection effect on highly-disguised spyware can be achieved.

Description

Technical field [0001] The invention belongs to the technical field of information security and invents a spyware adaptive induction and detection method based on computer immunity. Background technique [0002] From the prank at the beginning, to the accomplice of cybercrime, to the secret weapon of cyber warfare, malware has never stopped evolving in terms of purpose, concealment, and complexity. In recent years, with the popularization of Internet applications, a kind of malicious software with the purpose of stealing valuable information-spyware (Spyware) is becoming the number one threat to government, enterprise and personal information assets. [0003] Unlike traditional malicious software such as viruses and worms, which engage in large-scale destruction, the purpose of spyware is not to damage computer systems or spread in the network, but to steal privacy or confidential information from computers to bring benefits to hackers or intelligence agencies. Typical Advanced Pe...

AI Technical Summary

Problems solved by technology

However, when detecting latent spyware, these methods are also prone to false negatives because they cannot generate significant red flags.

[0013] In general, the existing behavior-based detection methods have the ability of self-adaptation, low false alarm and anti-latency to varying degrees, but there is no method that can have these three characteristics at the same time.

Images