An Artificial Immune Antivirus System

In this book, we consider the aspects of designing a computer immune system for virus detection and elimination using components and techniques found in the biological immune system. In the modeling of the biological immune system, we consider the use of three different kinds of loose matching: Hamming Distance, R-Contiguous Symbols, and Hidden Markov M odels (HMMs). Experiments with virus infected programs and HMMs are presented. HMMs are trained on static code from non-infected programs and on traces of systems calls generated by executions of non- infected programs. The programs are infected with a virus and the HMMs ability to detect the infections is tested. It is concluded that HMMs can successfully detect virus infections in programs from static code and from traces of system calls generated by executions of programs.