基于木马通信协议分析的Snort规则的制定

Based on Snort Found a Way Unknown Trojan Horses

提出了基于木马snort规则的制定的思路,首先,搭建实验环境,分别对两台测试机器种上木马的客户端和服务器端,然后用Wireshark软件对木马客户端和服务器端的网络通信进行捕捉进行分析,并发现网络数据包可疑的特征,最后把发现可疑的特征制定成Snort规则,并用基于Windows的可视化入侵检测进行检测,从而能对已知的木马进行实时报警。

This paper presents the analysis of communication protocols based on the Trojan snort rule-making ideas, first, to build experimental environment, were planted Trojan＇s client and server on the two test machines, and then use Wireshark software to capture the client and server of Trojan＇ s Network communications to analysis and found that the characteristics of suspicious network packet and finally extractthe characteristics of suspicious into Snort rules, Finally we use Windows- based visualization intrusion detection to testing, then we can be a Trojan horse known for real-time alerts.