API（Application Program Interface） is widely used to analyze Windows program behaviors for run-time malware detection.However,API call sequences can be manipulated to circumvent detection.In order to solve this problem,a novel method of run-time malware detection is proposed based on IRP（I/O Request Packet）.In this method,n-grams are employed to analyze IRP sequences for feature extraction,and,by combining the negative selection algorithm（NSA） and the positive selection algorithm（PSA） in the artificial immune system（AIS）,n-grams existing only in malicious IRP sequences are selected as detectors.Experimental results indicate that the proposed method outperforms both the NSA and the dendritic cell algorithm in terms of false detection rate and detection efficiency.