基于心跳行为分析的木马快速检测方法

Trojan Rapid Detection Method Based on Heartbeat Behavior Analysis

基于通信行为分析的木马检测算法的计算复杂度较高。为此,提出一种基于心跳行为分析的木马快速检测方法,通过对木马通信中心跳行为的描述,选取2个会话特征对木马通信流与正常通信流进行分类,基于该方法设计一个木马快速检测系统TRDS。实验结果表明,TRDS能够在百兆线速网络中快速有效地检测出木马通信。

Trojan detection algorithm based on behavior analysis of communication has high computational complexity. Addressing the problem, this paper proposes a Trojan rapid detection based on heartbeat behavior analysis. The method selects two session attributes to describe the difference between Trojan communication flow and normal communication flow on the basis of description of heartbeat behavior in the Trojan communication large numbers of analysis on Trojan samples. And then Trojan Rapid Detection System（TRDS） is built based on the method. Experimental results show that TRDS can detect the Trojan communication in the 100 Mbit/s network rapidly and efficiently.