基于网络通信指纹的启发式木马识别系统  

Heuristic Trojan Identification System Based on Network Communication Fingerprint

作　　者：唐彰国[1] 李焕洲[1] 钟明全[1] 张健[1] 

机构地区：[1]四川师范大学网络与通信技术研究所

出　　处：《计算机工程》2011年第17期119-121,139,共4页Computer Engineering

基　　金：四川省应用基础研究基金资助项目(07JY029-011);四川省教育厅基金资助项目(08ZA043)

摘　　要：对比传统木马检测技术的原理及特点,根据网络数据流检测木马的需求,提出一种基于网络通信特征分析的木马识别方法。引入通信指纹的概念扩展通信特征的外延,用实验方法归纳木马在连接、控制和文件传输阶段表现出的通信指纹信息,设计并实现一个启发式木马网络通信指纹识别系统。测试结果表明,该系统运行高效、检测结果准确。This paper discusses the trojan detection technique,and a detail contrast research of related characters is given.In order to provide trojan detection based on network data flow,a trojan identification method based on network communication fingerprint is broutht forward.The concept of communication fingerprint is introduced to expand the extension of the communication features.Through the experimental method the fingerprints information of trojan for each phase such as connection,control and file transfer can be highlighted.On that basis,a heuristic identification system for trojan based on network communication fingerprint is designed and implemented.Test results indicate that the system runs efficient and the results are accurate.

关 键 词：木马识别 通信指纹 启发式 深度包检测 数据流 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]