基于行为检测的窃密型木马检测研究

Detection Research on Behavior-based Detection of Theft-type Trojan

针对窃密型木马伪装技术不断发展,窃密型木马检测难度越来越高的现状,提出基于行为检测的窃密型木马检测方案.通过对常见窃密型木马通信机制建模分析,构建窃密型木马的几种通信模式.为了提高窃密型木马检测精度,以窃密型木马通信行为特征,设计了基于完整会话的窃密型木马检测方案.通过对500组实验数据测试表明,笔者设计的窃密型木马检测方案漏检率为6.8%,误报率为2.7%,优于传统的木马检测方案.

As the ceaseless development of theft-type Trojan camouflage technology, it is increasing difficult to detect it at present, this paper put forwarded a detection program based on behavior detection. By modeling analysis to common theft Trojan communication mechanism, several communication modes have been set up. Characterized by Theft Trojan communication behaviors, the program was designed to improve the theft Trojan detection accuracy, which based on the full session. By testing 500 set of experimental data, it showed that the undetected rate of the theft-type Trojan detection program designed this paper was 6.8% ; the false alarm rate was 2.7%, which was better than the traditional Trojan detection program.