Trojan horse detection method based on computer memory analysis technology

Abstract

The invention discloses a Trojan horse detection method based on computer memory analysis technology, which comprises the following steps: behavior monitoring, malicious code detection, comprehensiveanalysis of disk information, comprehensive correlation analysis, and detection result presentation. Behavior monitoring includes process operation, registry operation, file operation and network datamonitoring. Malicious code detection includes dynamic link library detection, malicious process detection, hidden process detection, driver detection. Disk information comprehensive analysis includesregistry startup key, file scanning, PE file parsing. The detection method of the trojan horse of the invention can effectively prevent the influence of the rootkit attack on the detection result ofthe trojan horse by using the technology to detect such malicious code without decryption.

Description

technical field [0001] The present invention relates to a method for detecting a Trojan horse, more specifically, to a method for detecting a Trojan horse based on computer memory analysis technology. This method will be applied in the field of information security, mainly for the detection of information security incidents and various computer attack incidents. Background technique [0002] a). Trojan horse; [0003] The name comes from the "Trojan horse" in ancient Greek mythology, because this type of malicious program, like the Trojan horse, is characterized by strong concealment and is not easy to be found. Here it specifically refers to a type of spy code that lurks after entering the host computer and sends information about the host computer to the Trojan horse operator. Once entering the computer, the Trojan horse program will actively search for system resources, obtain necessary legal conditions for existence, or avoid being captured and killed. After that, the ...

AI Technical Summary

Problems solved by technology

[0024] With the continuous development and maturity of malicious code detection technology, many malicious code detection methods have emerged. However, these methods have their limitations in the detection of special Trojans: signature scanning and broad-spectrum feature methods are difficult to find unknown malicious code. ; The heuristic method has a high false positive rate and is difficult to apply; the sandbox method is easily detected and circumvented by malicious code; the full traffic analysis method is difficult to detect unknown Trojans encrypted by communication

Images