Trojan horse detection method based on Trojan horse virus type classification modeling

Abstract

The invention discloses a Trojan horse detection method based on Trojan horse virus type classification modeling. The method comprises following steps of (1) classifying found Trojan horse according to characteristics; (2) forming a Trojan horse identification class library; (3) collecting characteristics of an operation system, identifying the Trojan horse through the Trojan horse identification class library in the step (2), and positioning in the belonging categories and characteristics of Trojan horse in; (4) positioning suspicious items; (5) according to the collected characteristics of the operation system in the step (3), conducting pattern matching in the class library through an algorithm to identify the Trojan horse in the system; (6) finding the same Trojan horse with pattern matching in the class library, and judging the Trojan horse to be detected. The method can conduct rapidly identification and analysis for existing Trojan horse in the system and particularly for the unknown novel Trojan horse. Compared with a traditional detection manner, detection capability for the Trojan horse, particularly for recognition and detection capability for the unknown novel Trojan horse has great improvement.

Description

technical field [0001] The invention relates to a Trojan horse detection method, in particular to a Trojan horse detection method based on classification and modeling of Trojan horse virus types. Background technique [0002] At present, network security incidents such as webpage tampering, network hacking, denial of service attacks, system intrusion, worm virus propagation, and malware threats are common, among which the infection of computer virus Trojan horse programs is the most prominent. The Trojan horse program has become a serious security threat because of its strong concealment and other characteristics to steal passwords and control systems. The rapid development of Trojan horse writing technology has brought new challenges to security software. The application of code deformation and packing technology has made various Trojan horse variant programs rampant on the network, making traditional Trojan horse detection technology useless. Contents of the invention ...

AI Technical Summary

Problems solved by technology

The rapid development of Trojan horse writing technology has brought new challenges to security software. The application of code deformation and packing technology has made various Trojan horse variant programs rampant on the network, making traditional Trojan horse detection technology useless.

Images