一种基于网络行为分析的反弹式木马检测方法  

Detecting Rebound Port Trojan Based on Network Behavior Analysis

作　　者：赵天福[1] 周丹平[1] 王康[1] 张博[1] 

机构地区：[1]江南计算技术研究所,江苏无锡214083

出　　处：《信息网络安全》2011年第9期80-83,共4页Netinfo Security

摘　　要：该文首先对反弹式木马的通信过程进行了分析,建立了反弹式木马的网络行为模型,提出了数据包簇的概念,并给出了形式化描述。接着从网络行为分析的角度,提出了通过3个网络行为特征去检测木马心跳行为,通过6个网络行为特征去检测反弹式木马的交互性操控行为,并给出了实现算法。实验结果表明,该算法对反弹式木马具有较好的检测效果。The communicating process of rebound port Trojan is analyzed firstly, then the network behavior model of rebound port Trojan is constructed and the PACKET-CLUSTER concept with formalization description is proposed. Three network behavior characteristics of Trojan heartbeat and six network behavior characteristics of Trojan operation are proposed. Finally the implement methods are proposed. The experimental results show that our method can efficiently detect rebound port Trojan.

关 键 词：反弹式木马检测 网络行为分析 心跳行为 操控行为 数据包簇 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]