中文摘要：

现有的计算机病毒检测方法利用病毒特征码来检测病毒,已经不能适应病毒技术的发展,特别是其无法检测出病毒的新变种与未知病毒.受自然免疫系统的启发,该文提出了一种基于人工免疫的利用计算机病毒代码相关性的计算机病毒特征提取方法.这种特征提取方法在底层提取出与病毒相关的字节模式,在相对更高的层面上记录这些字节模式之间的共同作用信息,之后利用阴性选择算法提取出计算机病毒检测基因库,实现了对训练集上合法程序的完美记忆,从而保证了该文方法的误判率处于极低的水平.计算机病毒检测基因库在个体层上存储病毒样本,一个样本中储存了若干个不定长的基因,充分利用了同一个样本的不同基因代码之间的相关性.为了尽可能少地丢失有效信息,这种方法在基因层上对基因进行匹配,在个体层上对可疑程序进行分析,最终由整个计算机病毒检测基因库做出分类决策.实验表明：此方法对未知病毒的平均识别率达到94%,同时对合法程序的误判率保持在2%之内,具有较强的泛化能力,能够有效识别病毒伪装,检测出已知病毒的新变种,对未知病毒也具有较强的识别能力.

英文摘要：

Existing anti-virus methods make use of signatures to detect malicious codes.They are inefficient to detect various forms of computer viruses,especially new variants and unknown viruses.Inspired by biologic immune system,a novel artificial immune based signature extraction method is proposed.This method automatically identifies bit patterns that correlate with viruses using instruction frequency and file frequency,and then identifies higher-level genes that are associated with viruses,generating a detecting virus gene library using the negative selection algorithm which leads to a fairly low false positive rate compared with the traditional signature-based methods.The advantages of our proposed method are described as follows.In the feature extraction phase,the detecting virus gene library stores virus samples with variable number of variable length genes at individual level,and uses multiple genes coexistence in one virus to avoid the possible loss of information considerably,fully taking the advantages of relevance between viral instructions within a virus program;in the classification phase,suspicious programs are analyzed at individual level in contrast to the existing gene matching technique.Experimental results indicate that the proposed method yields high detection rates for obfuscated viruses with an averaged recognition rate of 94% in real-world conditions,the false positive rate can be maintained below 2%.The method has a good generalization ability,and is able to effectively and efficiently detect new variants of known virus and unknown viruses.