采用行为分析的单机木马防护系统设计与实现  

Design and implementation of Trojan horse protection system based on behaviors analysis

作　　者：王泽东[1,2] 刘宇[1,2] 朱随江[1,2] 刘宝旭[2] 潘林[1,2] 

机构地区：[1]中国科学院研究生院,北京100049 [2]中国科学院高能物理研究所计算中心,北京100049

出　　处：《计算机工程与应用》2011年第11期46-48,148,共4页Computer Engineering and Applications

基　　金：国家科技支撑计划重点项目(No.2009BAH52B06);中科院知识创新重点方向项目(No.YYYJ-1013)

摘　　要：针对基于特征代码的静态木马检测技术的不足,通过实时监控程序的可疑行为,运用贝叶斯算法分析程序行为特征进而发现木马程序,并对恶意木马程序的非授权操作进行修复,设计并实现了一个基于行为分析的单机木马防护系统。实验表明:该木马防护系统在对检测率影响较小的前提下,显著降低了误报率。Based on behaviors analysis,this paper designs and realizes a Trojan horse protection system for PC.The system overcomes the shortage of Trojan horse detection techniques which based on static feature code and monitors suspicious behavior of the program,using Bayesian algorithm for analysis of the program behavior characteristics,Trojan horse program will be killed once found.The system repairs the software damaged and protects operating system better.Experiments show that the Trojan horse protection system significantly reduces false positive rate,with few impact on detection rate.

关 键 词：行为分析 贝叶斯算法 木马 防护 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]