A Research On Automatic Program Protection Based On Immune Principle

The appearance of computer viruses has caused huge damage to personal computersystems and network securities. With the expansion of computer applications to newareas, the number of viruses has been increasing rapidly. Virus has been evolving andunder fast development. So far most of the anti-virus software are capable of protectingfrom known viruses effectively, however they can hardly guard against unknownviruses. The result is, protection always comes after the damage caused by virus. Theprotection is always passive, and lags behind the development of attacking techniquesof viruses. This is not a good solution to the problem of protecting computer resources.The problems in computer virus detection are similar to those in biological immunesystem. The immune mechanisms in biological immune system have solved theproblems effectively. Simulating the biological immune system in computer artificialimmune system is one of the ways to solve the problem. This research is conducted onapplying the principle of biological immune system to anti-virus investigation viaartificial immune system.This thesis includes the followings:1. The most recent development of computer virus is investigated. Problems intraditional virus detection techniques are analyzed. The principle on artificialimmune system is explained and present situation in the research is described.2. A proposal on program automatic protection system is suggested based onimmune principle and traditional anti-virus techniques. The functionalities andfeatures of the system are indicated. The overall architecture of the system isdesigned. The system has layered structure with 3 layers' defense. It has multipleimmune properties and is capable of preventing known and unknown viruses,protecting the resource integrity in computer.3. The key techniques in program protection system are investigated, whichinclude structure of Self set and Nonself set, structure of detector and matchalgorithm, and the structure techniques of detector set. Emphasis is put on theconstruction technology of Self set that supports the recovering of original data,and a new construction method of detector set is proposed. Self set hassignificant importance in the protection of small scale program systems such asindustry worksite control. The construction of new detector set greatly decreasedthe complexity of detector storing space. It also decreases the computingcomplexity on "Nonself" detection. This can be well applied to practicalprogram protection systems.At the end of this paper, it summarizes the work as well as looks ahead about the futureresearch.