Abstract: In order to solve the problems existing in the current malware detection, a new malware detection method based on immune was proposed. In this method, the IRP request sectuences created by running programs are regarded as antigen, and the normal programs in operating system arc self, malwares arc nonsclf. I}he nonself will be detected by some antibodies using artificial immunology. Experimental results reveal that this model has high true positive rate, and low false positive and false negative rate.

Key words: Artificial immune, Malware, Malware detection, Anti-virus