Danger Feature-Based Negative Selection Algorithm

This chapter presents a danger feature-based negative selection algorithm (DFNSA). In the DFNSA, the danger feature space is divided into four parts, and the information of danger features is reserved as much as possible, laying a good foundation for measuring the danger of a sample. A danger feature is a feature with dangerous properties, that is able to identify its corresponding dangerous operations. It is the basic element for an immune system to decide whether an immune response should be produced. In order to incorporate the DFNSA into the procedure of malware detection, a DFNSA-based malware detection (DFNSA-MD) model is proposed. The danger of a sample is measured precisely in this way and used to classify the sample. Comprehensive experimental results suggest that the DFNSA is able to reserve as much information about the danger features as possible, and the DFNSA-MD model is effective to detect unseen malware.