指出了當(dāng)前反病毒軟件在檢測(cè)未知木馬方面的不足，介紹了人工免疫系統(tǒng)在反病毒軟件自適應(yīng)性方面的優(yōu)點(diǎn)，以及人工免疫機(jī)制在木馬檢測(cè)方面的可行性；通過(guò)對(duì)木馬新技術(shù)的分析，用一個(gè)木馬模型證明了現(xiàn)在計(jì)算機(jī)安全體系的不足，提出將木馬檢測(cè)從反病毒軟件中遷移到免疫型入侵檢測(cè)系統(tǒng)中作為子系統(tǒng)，利用其免疫機(jī)制來(lái)提高木馬檢測(cè)的自適應(yīng)能力；并同時(shí)提出了依據(jù)進(jìn)程的系統(tǒng)資源使用狀況來(lái)映射進(jìn)程的系統(tǒng)調(diào)用的行為模式，以此建立了基于人工免疫機(jī)制的木馬檢測(cè)模型。

This paper points out the deficiency in detecting the unknown Trojan horse of the present anti-virus software at first, introduces the advantage of artificial immune system in self-adaptability aspect, and points out the feasibility of artificial immunity mechanism in Trojan horses detection; Then through an analysis about the new technology of Trojan horses, proves the deficiency of current computer security system with a Trojan horses model, presents the transfer of Trojan horses detection from the anti-virus software to the subsystem of immune IDS, improves the self-adaptive capacity of Trojan horses detection with its immune mechanism; Finally, a behavior mode is put forward, which is mapped from the using situation of process systematic resource to the process systematic call, and by this means, a Trojan horse detection model based on artificial immunity mechanism is set up.