基于线程管理-端口截听的木马检测系统的设计

Design of Trojan Horse Detecting System-Based on Thread Management and Port Intercepting

随着互联网越来越生活化,层出不穷的木马已是网络安全的主要威胁,其隐蔽性很强,使一般检测工具难以检测.本系统通过直接扫描系统内核中的活动线程以及截拦活动线程的网络数据流量来进行木马的检测.可以检测出当前所有类型的进程隐藏木马.

With internet widely used in our daily life, the Trojan horses are emerging one after another and have become the main threat of network security. The deep hiding of the Trojan horses makes it difficult to detect them with ordinary tools. But this system discussed here can detect the Trojan horses by means of directly scanning active threads in system kernel and intercepting the network data flow of the active threads to find all types of current hidden processes.