Method and system for recall Trojan horse control site network behavior function reconstruction

Abstract

The invention provides a method and system for recall Trojan horse control site network behavior function reconstruction. The system comprises a secret shield disassembling analyzing module, a secret shield multi-path analyzing module and a secret shield Trojan horse control site generating module. The secret shield disassembling analyzing module analyzes a recall Trojan horse executive program by means of a static semantic analysis method so as to form a complete recall Trojan horse assembly code and obtain a code algorithm and a secret key material. The secret shield multi-path analyzing module obtains code execution path parameters, analyzes and constructs all possible paths, obtains detail information of network visiting and network function calling in the recall Trojan horse execution process and executes the paths. The secret shield Trojan horse control site generating module generates recall Trojan horse control site function program segments according to a generated encrypted secret key and the detail information of network visiting and network function calling, simulates a recall Trojan horse control site to respond to a recall Trojan horse request, finishes encrypted data verification and generates a report capable of reflecting recall Trojan horse control site network behavior functions. The method and system can safely and effectively reconstruct important functions of recall Trojan horse control site network behaviors.

Description

technical field [0001] The invention relates to the technical field of Trojan horses, in particular to the technical field of control and analysis of Trojan horses, in particular to a method and system for rebuilding network behavior functions of a control terminal of a rebounding Trojan horse. Background technique [0002] A rebound Trojan is a service program that resides in the user's computer, while the attacker controls the corresponding client program. The service program opens the connection resources of the user's computer through a specific port. Once the client program mastered by the attacker sends a request, the rebounding Trojan will connect with him and steal the user's information. [0003] After analyzing the characteristics of the firewall, the rebound port Trojan found that: the firewall often performs very strict filtering on incoming links, but neglects to prevent outgoing links. Therefore, contrary to general Trojan horses, the server (controlled end) ...

AI Technical Summary

Problems solved by technology

[0006] In view of the shortcomings of the prior art described above, the purpose of the present invention is to provide a method and system for rebuilding the network behavior function of the rebounding Trojan horse control terminal, which is used to solve the problems of difficult analysis and high risk in the analysis of the rebounding Trojan horse program in the prior art. question

Images