Method and system for monitoring Trojan Horse based on network communication behavior characteristic

Abstract

The invention provides a method and system for real-time monitoring Trojan Horse base on network communication behavior characteristic of Trojan Horse in network data flow, which belongs to the field of computer network security. Currently, Trojan Horse is capable of avoiding detection based on file characteristic and host behavior characteristic in prior art by various technical means. But behavior characteristic of Trojan Horse in network communication is relatively stable, that is application communication protocol thereof is unlikely to change. That is because the change to the protocol relates to simultaneous change to programs on both Trojan Horse customer and server, which needs re-implantation of the Trojan Horse, and also relates to the communication problem between different versions of the Trojan Horse program. Accordingly, based on the network communication behavior characteristic during Trojan Horse activation in the network data flow, not only the known Trojan Horses can be monitored, but also unknown flowered, shelled or variant Trojan Horse can be precisely monitored.

Description

technical field [0001] The invention relates to a method and system for real-time monitoring of Trojan horses based on network communication behavior characteristics, belonging to the field of computer network security. Background technique [0002] With the popularity and application of computers and networks, people are increasingly dependent on computers and networks. A large number of non-public or confidential important documents and personal information are stored on each work and home computer. Once these computers are implanted with Trojan horse programs, their information will be stolen, resulting in the leakage of important information and secret files. , personal privacy information exposure and economic losses; in addition, Trojan horses can also destroy information systems, causing system paralysis and loss of important data. [0003] At present, the detection and protection methods of Trojans can be summarized into two categories. One is the traditional detec...

AI Technical Summary

Problems solved by technology

For unknown, flowered, packed or mutated Trojan horse programs, it is necessary to re-analyze and extract file signatures, and then update the signature database. This is a completely passive defense method that does not fundamentally solve the problem

The Trojan horse firewall only simply monitors suspicious connections on the network, and cannot effectively prevent those Trojan horse programs that communicate using standard protocols. At the same time, software needs to be installed on the user host, which takes up system resources and affects system performance.

Images