Run-time malware detection strategies are efficient and robust, which get more and more attention. In this paper, we use I/O Request Package (IRP) sequences for malware detection. N-gram will be used to analyze IRP sequences for feature extraction. Integrated Negative Selection Algorithm (NSA) and Positive Selection Algorithm (PSA), through a selection of n-gram sequences which only exist in malware IRP sequences, we have more than 96% true positive rate and 0% false positive rate.