Full Text:   <1859>

CLC number: TP301

On-line Access: 2011-06-07

Received: 2010-12-28

Revision Accepted: 2011-03-06

Crosschecked: 2011-05-05

Cited: 5

Clicked: 3896

Citations:  Bibtex RefMan EndNote GB/T7714

-   Go to

Article info.
1. Reference List
Open peer comments

Journal of Zhejiang University SCIENCE C 2011 Vol.12 No.6 P.443-454


An immune local concentration based virus detection approach

Author(s):  Wei Wang, Peng-tao Zhang, Ying Tan, Xin-gui He

Affiliation(s):  MOE Key Laboratory of Machine Perception, Peking University, Beijing 100871, China, Department of Machine Intelligence, School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China

Corresponding email(s):   weiwang@cis.pku.edu.cn, ytan@pku.edu.cn

Key Words:  Local concentration, Artificial immune system, Virus detection

Share this article to: More |Next Article >>>

Wei Wang, Peng-tao Zhang, Ying Tan, Xin-gui He. An immune local concentration based virus detection approach[J]. Journal of Zhejiang University Science C, 2011, 12(6): 443-454.

@article{title="An immune local concentration based virus detection approach",
author="Wei Wang, Peng-tao Zhang, Ying Tan, Xin-gui He",
journal="Journal of Zhejiang University Science C",
publisher="Zhejiang University Press & Springer",

%0 Journal Article
%T An immune local concentration based virus detection approach
%A Wei Wang
%A Peng-tao Zhang
%A Ying Tan
%A Xin-gui He
%J Journal of Zhejiang University SCIENCE C
%V 12
%N 6
%P 443-454
%@ 1869-1951
%D 2011
%I Zhejiang University Press & Springer
%DOI 10.1631/jzus.C1000445

T1 - An immune local concentration based virus detection approach
A1 - Wei Wang
A1 - Peng-tao Zhang
A1 - Ying Tan
A1 - Xin-gui He
J0 - Journal of Zhejiang University Science C
VL - 12
IS - 6
SP - 443
EP - 454
%@ 1869-1951
Y1 - 2011
PB - Zhejiang University Press & Springer
ER -
DOI - 10.1631/jzus.C1000445

Along with the evolution of computer viruses, the number of file samples that need to be analyzed has constantly increased. An automatic and robust tool is needed to classify the file samples quickly and efficiently. Inspired by the human immune system, we developed a local concentration based virus detection method, which connects a certain number of two-element local concentration vectors as a feature vector. In contrast to the existing data mining techniques, the new method does not remember exact file content for virus detection, but uses a non-signature paradigm, such that it can detect some previously unknown viruses and overcome the techniques like obfuscation to bypass signatures. This model first extracts the viral tendency of each fragment and identifies a set of statical structural detectors, and then uses an information-theoretic preprocessing to remove redundancy in the detectors’ set to generate ‘self’ and ‘nonself’ detector libraries. Finally, ‘self’ and ‘nonself’ local concentrations are constructed by using the libraries, to form a vector with an array of two elements of local concentrations for detecting viruses efficiently. Several standard data mining classifiers, including K-nearest neighbor (KNN), radial basis function (RBF) neural networks, and support vector machine (SVM), are leveraged to classify the local concentration vector as the feature of a benign or malicious program and to verify the effectiveness and robustness of this approach. Experimental results show that the proposed approach not only has a much faster speed, but also gives around 98% of accuracy.

Darkslateblue:Affiliate; Royal Blue:Author; Turquoise:Article


[1]Chao, R., Tan, Y., 2009. A Virus Detection System Based on Artificial Immune System. Int. Conf. on Computational Intelligence and Security, 1:6-10.

[2]Chen, S., Cowan, C.F., Grant, P.M., 1991. Orthogonal least squares learning algorithm for radial basis function networks. IEEE Trans. Neur. Networks, 2(2):302-309.

[3]Christodorescu, M., Jha, S., Kruegel, C., 2007. Mining Specifications of Malicious Behavior. Proc. 6th Joint Meeting of the European Software Engineering Conf. and the ACM SIGSOFT Symp. on the Foundations of Software Engineering, p.5-14.

[4]Egele, M., 2008. Behavior-Based Spyware Detection. VDM Verlag, Saarbrucken, Germany.

[5]Henchiri, O., Japkowicz, N., 2006. A Feature Selection and Evaluation Scheme for Computer Virus Detection. Proc. 6th Int. Conf. on Data Mining, p.891-895.

[6]Hofmeyr, S.A., Forrest, S., Somayaji, A., 1998. Intrusion detection using sequences of system calls. J. Comput. Secur., 6:151-180.

[7]Ilgun, K., Kemmerer, R.A., Porras, P.A., 1995. State transition analysis: a rule-based intrusion detection approach. IEEE Trans. Software Eng., 21(3):181-199.

[8]Jacob, G., Debar, H., Filiol, E., 2008. Behavioral detection of malware: from a survey towards an established taxonomy. J. Comput. Virol., 4(3):251-266.

[9]Kephart, J.O., 1994. A Biologically Inspired Immune System for Computers. Proc. 4th Int. Workshop on Synthesis and Simulatoin of Living Systems, p.130-139.

[10]Kirda, E., Kruegel, C., Banks, G., Vigna, G., Kemmerer, R.A., 2006. Behavior-Based Spyware Detection. Proc. 15th Conf. on USENIX Security Symp., p.1-16.

[11]Kolter, J.Z., Maloof, M.A., 2006. Learning to detect and classify malicious executables in the wild. J. Mach. Learn. Res., 7:2721-2744.

[12]Schultz, M.G., Eskin, E., Zadok, E., Stolfo, S.J., 2001. Data Mining Methods for Detection of New Malicious Executables. Proc. IEEE Symp. on Security and Privacy, p.38-49.

[13]Tan, Y., Xiao, Z.M., 2007. Clonal Particle Swarm Optimization and Its Applications. IEEE Congress on Evolutionary Computation, p.2303-2309.

[14]Wang, J., Deng, P.S., Fan, Y., Jaw, L., Liu, Y., 2003. Virus Detection Using Data Mining Techinques. Proc. IEEE 37th Annual Int. Carnahan Conf. on Security Technology, p.71-76.

[15]Wang, W., Zhang, P.T., Tan, Y., He, X.G., 2009. A Hierarchical Artificial Immune Model for Virus Detection. Int. Conf. on Computational Intelligence and Security, 1:1-5.

[16]Wang, W., Zhang, P.T., Tan, Y., 2010. An immune concentration based virus detection approach using particle swarm optimization. LNCS, 6145:347-354.

Open peer comments: Debate/Discuss/Question/Opinion


Please provide your name, email address and a comment

Journal of Zhejiang University-SCIENCE, 38 Zheda Road, Hangzhou 310027, China
Tel: +86-571-87952783; E-mail: cjzhang@zju.edu.cn
Copyright © 2000 - Journal of Zhejiang University-SCIENCE