基于网络流量特征的未知木马检测技术及其实现

Technology and Implementation to Detect Unknown Trojan based on Network Flow Characteristics

文章首先介绍了当前网络环境下木马检测的经典方法、优缺点及其面临的挑战,然后从木马网络通信的本质特征出发,提出了基于网络流量特征的未知木马检测方案,描述了原型系统的设计方案及实现。通过测试结果表明,该方案可有效检测各类未知木马软件,保证高检出率的同时,误报率低。

Focused on the essence of Trojan＇s network communication, this paper presents an unknown Trojan detecting scheme based on the network flow characteristics, and describes the key technology of the prototype system. The experiment results indicate that the scheme has great effect to detect the unknown Trojan with low false positive rate and high detection rate.