Research On The Trojan Detection Technology Based On Immune Algorithm

The rapid development of computers and network brings convenience to people, at the same time, brings a variety of security risk. Computer network is attacked and damaged by emerging computer viruses. The most harmful computer virus is trojan horse. The spread of trojan in the Internet leads to the theft of state secrets and personal privacy, brings incalculable loss to individuals, corporations and countries.The traditional trojan detection is short on detection accuracy, false positive rate and false negative rate. Especially, for the unknown trojan detection the traditional technology is more powerless. Biological immune system has some advantages in memory, self-learning and adaptability, all these can improve the efficiency of trojan detection. This paper is based on artificial immune algorithm which is applied to the trojan horse detection, and has completed the following researches:1.Studied the trojan detection technology and the trojan working mechanism, analyzed the algorithm of artificial immune system for reference, and mapped the relationship between trojan detection system and the artificial immune system.2. According to defect of traditional negative selection algorithm in detection efficiency, an improved algorithm based on parallel computing and multi-feature matching region is proposed. First, the algorithm divides a random string into multiple feature regions, each region corresponds to a set of detector. Among the regions, the algorithm does a second match with a r-continuous bits matching method. At the same time, under the parallel computing, algorithm sets a matching threshold to confirm the match.3. Studied on the clonal selection algorithm, the article does another negative selection after a crossover and mutation process of traditional clonal selection algorithm. This can avoid producing new individuals matching autologous, prevent the occurrence of autoimmune. After that, during the variation process, paper take a mechanism in which probability is inversely proportional to the degree of affinity, to ensure the diversity of detector. Finally, an additional circulation mechanism is introduced into paper to dynamically update detectors and enhance the ability of global optimization.4. A trojan detection model based on immune algorithm is proposed. The model has some advantages of the immune system, such as adaptability, distribution, self-learning and robustness. A simulation network environment is built to analysis and test the improved algorithm and the overall model.Experimental results show that, when the length of matching bit and random string is increased, the numbers of candidate detector has a flat increase speed, the burden of system also has a slow increase speed. Therefore, the model has a good detection efficiency. Similarly, the experiment shows that the improved clonal selection algorithm has a good effectiveness. The improved algorithm has a fast learning speed.When the system detectes a same antigenit, it can improve the system's response speed , the model also has a good detection results for the unknown trojan.