指出了當前反病毒軟件在檢測未知木馬方面的不足，介紹了人工免疫系統(tǒng)在反病毒軟件自適應性方面的優(yōu)點，以及人工免疫機制在木馬檢測方面的可行性；通過對木馬新技術的分析，用一個木馬模型證明了現(xiàn)在計算機安全體系的不足，提出將木馬檢測從反病毒軟件中遷移到免疫型入侵檢測系統(tǒng)中作為子系統(tǒng)，利用其免疫機制來提高木馬檢測的自適應能力；并同時提出了依據(jù)進程的系統(tǒng)資源使用狀況來映射進程的系統(tǒng)調用的行為模式，以此建立了基于人工免疫機制的木馬檢測模型。

This paper points out the deficiency in detecting the unknown Trojan horse of the present anti-virus software at first, introduces the advantage of artificial immune system in self-adaptability aspect, and points out the feasibility of artificial immunity mechanism in Trojan horses detection; Then through an analysis about the new technology of Trojan horses, proves the deficiency of current computer security system with a Trojan horses model, presents the transfer of Trojan horses detection from the anti-virus software to the subsystem of immune IDS, improves the self-adaptive capacity of Trojan horses detection with its immune mechanism; Finally, a behavior mode is put forward, which is mapped from the using situation of process systematic resource to the process systematic call, and by this means, a Trojan horse detection model based on artificial immunity mechanism is set up.