Method, system and device for traceability of Trojan horse files

Abstract

The invention discloses a Trojan horse file tracing method, system and the equipment. The gene features of the Trojan files are depicted from multiple angles, multiple forms and multiple levels through three-factor model analysis, more comprehensive and more accurate Trojan fingerprint data are provided for Trojan file tracing, the analysis and recognition capability of the Trojan files is improved, and more complete data resources are provided for Trojan file tracing. And the cloud server is linked with the cloud hacker fingerprint archive library, so that the association and traceability ofthe Trojan files can be carried out by combining the behavior habits organized by the hackers, the analysis dimension of the Trojan files is expanded, and the Trojan files which are deeper to hide andmore skillful in design can be identified and traced. Besides, a Trojan file tracing method for multi-source data comprehensive evaluation is adopted, fusion, association and application of multi-source data are truly achieved, high-level and complex Trojan samples can be recognized, and the method has more accurate judgment and tracing capacity.

Description

technical field [0001] The present invention relates to the technical field of traceability of Trojan horse files, in particular to a method, system and equipment for traceability of Trojan horse files. Background technique [0002] There are currently two mainstream technical methods for traceability of Trojan files, one is the feature matching analysis method, and the other is the sandbox detection and analysis method. The feature matching analysis method generally describes the characteristics of the Trojan horse through key information items such as the Hash value of the file, the online domain name of the Trojan horse, and the link address, and uses it as a key indicator to identify and trace the source of the Trojan horse file. The sandbox detection and analysis method uses Sandboxie (sandbox, network programming virtual execution environment) to create an execution environment that restricts program behavior according to security policies. When the file is running in ...

AI Technical Summary

Problems solved by technology

[0009] The purpose of the embodiments of the present invention is to provide a Trojan file traceability method, system and equipment to solve the problem that the existing Trojan file traceability technology cannot be effectively identified due to single detection source, simple detection means, backward traceability method, and isolated use of data. Problems with Trojan horse files with feature confusion, packer avoidance, and protection evasion processing

Images