Immunity-Based Model for Malicious Code Detection

Abstract

More and more unknown malware that hide itself in the operating system kernel make the traditional antivirus difficult to detect. Inspired by the biological immune system, we proposed a novel immunity-inspired model for malware detection—IMD. The IMD model extracts the I/O Request Packets (IRPs) sequence produced by the process running in kernel mode as antigen, defines the normal benign programs as self programs, and defines the malwares as nonself programs. By the process behavior monitoring and the family gene analysis, the model can monitor the evolution of malware. The model generates the immature antibodies by vaccination, produces mature antibodies by clonal selection and gene evolution, and then learns and evolutionary identifies the unknown malware by the mature antibodies. Experiments show that the proposed model for unknown malware detection has high detection rate, low false-positive rate, and low omission rate.