基于Linux的未知木马检测系统研究及实现  

Unknown Trojan Linux-based Detection System Research and Realization

作　　者：张晛譞[1] 范明钰[1] 

机构地区：[1]电子科技大学计算机学院,四川成都610054

出　　处：《计算机安全》2010年第5期1-3,共3页Network & Computer Security

基　　金：国家863项目(2009AA01Z403);国家863项目(2009AA01Z435)

摘　　要：针对传统木马检测方法对未知木马识别能力低下的缺陷,结合行为监控和人工免疫学,建立并实现了一个基于Linux的未知木马检测系统。该系统具备自主检测和自学习功能,结合内容检测,利用网络监控检测局域网内部计算机的木马存在情况。实验测试表明,该系统降低了检测的漏报率,具有良好的检测效果。According to the defects of the traditional technology of the detection of the Trojan,combination of behavior monitoring and artificial immune,established and implemented a Linux-based detection system of unknown Trojan.The system has self-monitoring and self-learning function,combined with content inspection,used within the LAN network monitoring detected the presence of local area network computer Trojan horse.Experimental tests show that the system reduces the omission rate,have good detection results.

关 键 词：未知木马检测 行为监控 网络监控 内容检测 

分 类 号：TP274[自动化与计算机技术—检测技术与自动化装置]