Method and device for detecting Trojans by analyzing network behaviors

Abstract

The invention relates to a method and a device for detecting Trojans by analyzing network behaviors. The Trojans are detected by analyzing and comparing behavior characteristics. The method comprises the following steps of: searching the network behaviors in a local area network; analyzing the representative behavior characteristics of the network behaviors, and detecting the Trojans in real time through the network behaviors such as external linkage of the Trojans, information stealing and outbound information. The device consists of an acquisition device and an analyzer, wherein the acquisition device acquires a network data packet and sends the network data packet to the analyzer; the analyzer reorganizes data, extracts the representative behavior characteristic of the data, performs correlation analysis with a Trojan characteristic library, generates a security event report and presents the security event report to a fore system. The Trojans are detected by using behavior characteristic analysis technology; and compared with the conventional program characteristic code comparison technology, the method of the invention has the advantages of capability of detecting the Trojans in known types and in unknown types, and good detection effect particularly for mutation and variation such as packed and kill-free Trojans.

Description

technical field [0001] The invention belongs to the field of network security, in particular to a method and a device for detecting a Trojan horse program. Background technique [0002] Now, the scope of Trojan horse spread on the Internet is getting wider and wider, causing more and more harm. [0003] Traditional antivirus software uses signature code comparison technology to kill viruses. The signature code is to get the original program of the virus sample, propose a unique code similar to a fingerprint in the program, add it to the antivirus software, and then scan all files. If there is this signature code, it is a virus, which can be killed. [0004] This technique for detecting Trojan horses can only detect Trojan horses that have obtained samples. For unknown, packed, and mutated Trojan horses, because the signatures in the source program are inconsistent with the existing signatures, they cannot be detected. Contents of the invention [0005] The purpose of the...

AI Technical Summary

Problems solved by technology

[0004] This Trojan horse detection technology can only detect Trojan horses that have obtained samples. For unknown, packed, and mutated Trojan horses, because the signature code in the source program is inconsistent with the existing signature code, it cannot be detected.

Images