Malware Detection System Using Affinity Vectors

This chapter proposes an immune-based virus detection system using affinity vectors (IVDS) based on the negative selection and clonal selection algorithms in artificial immune system (AIS). AVDS first generates the detector set from virus files in dataset, negative selection is used to eliminate autoimmunity detectors for the detector set, while clonal selection is exploited to increase the diversity of the detector set in the non-self space. The affinity vectors of the training set and the testing set are used to train and test classifiers, respectively. Finally, based on the affinity vectors, three classic classifiers, that is, Support Vector Machine (SVM), radial basis kernel function (RBF) network and k-nearest neighbor (KNN), are used to verify the performance of the model. Experimental results showed that the IVDS with the rbf-SVM classifier has a strong generalization ability with a low false positive rate in detecting unknown viruses.