基于“行为模拟”的木马线索调查方法

Trojan investigation method based on behavior simulation

目的研究木马线索的提取、分析方法。方法针对"肉机"与黑客主机无法正常建立通信连接的情况,提出了一种基于"行为模拟"的调查方法。即搭建起一个实验环境,模拟黑客主机与"肉机"进行通信,诱使"肉机"产生通信数据,截获这些数据并从中提取出黑客的相关线索。结果提出的调查方法可以提取出一些"疑难"木马的相关痕迹。结论该方法可以应用于公安侦查破案。

Objective To explore a extraction and analysis method of Trojan. Methods Communication between simula- tion machine and victim machine was established first, then the data sent from simulation machine to victim machine were intercep- ted, and the Trojan was extract. Results Some Trojans were detected. Conclusion This method can be used in casework.