Kushnaryov M. Methods and models of malware recognition based on artificial immune systems

The dissertation is devoted to development of methods and models of malware recognition based on artificial immune systems that allow increasing the efficiency of computer security. The generalized model of malware heuristic analyzer is proposed. It performs probabilistic recognition based on weighted estimation of features that uses behavioural analysis based on emulator-derived data and analyses it using different intelligent technologies. The method of malicious programs detection is developed using artificial immune network. This method increases the accuracy and speed of recognition and can detect not only potentially malicious code but unknown viruses as well. The model of malware heuristic analyzer based on artificial neural network is proposed. The artificial neural network training is performed by the artificial immune system using the model of adaptive structured multiantibody to encode adjustable parameters of the artificial neural network. It allows not only efficient parameters identifying but also reducing number of neurons in hidden layers. To solve the task of malware recognition the model of artificial immune network is developed. This model is represented in the form of multiagent system to make it more generalized and able to change parameters and structure of the immune network. Experiments and comparative analysis of proposed methods and models are carried for different families of viruses and show the efficiency of the malware recognition.