一种基于网络行为分析的HTTP木马检测模型

A model of an HTTP-based Trojan detection based on network behavior analysis

基于HTTP协议进行网络通信的木马能够躲避部分网络安全监控系统的检测,是互联网安全的一个重大威胁。通过对该类木马样本和普通程序样本网络行为的对比分析,得到该类木马的6个网络行为特征,综合利用层级聚类、Davies-Bouldin指数和k-means聚类方法提出了一种木马检测模型,实现了HTTP木马检测。结果表明,该HTTP木马检测模型准确率较高,误报率较低。

HTTP-based Trojans which can avoid detection by a network security monitoring system are a major threat to internet security. In this paper we obtain six characteristics that can represent the network behavior of such Trojans through analyzing and comparing the network behavior of HTTP-based Trojan and normal program samples. We propose a model for Trojan detection that utilizes a single-linkage hierarchical clustering algorithm,the Davies-Bouldin index and a k-means clustering algorithm. The results show that the model of Trojan detection is suitable for detecting Trojans with high accuracy and low false positive ratios.