Method and system for rebuilding network behavior function of rebounding Trojan horse control terminal

Abstract

The present invention provides a method and system for rebuilding the network behavior function of the rebounding Trojan control terminal. The system includes: a secret shield disassembly analysis module, which uses a static semantic analysis method to analyze the execution program of the rebounding Trojan to form a complete assembly code of the rebounding Trojan. , and obtain the cryptographic algorithm and key material; the secret shield multi-path analysis module obtains the code execution path parameters, analyzes and constructs all possible paths and obtains the detailed information of network access and network function calls during the execution of the rebounding Trojan horse, and executes various path; the Midun Trojan control terminal generation module generates a rebound Trojan control terminal function program segment according to the generated encryption key, the detailed information of the network access and network function call; the simulated rebound Trojan control terminal responds to the rebound Trojan request and completes the encryption Data verification, generating a report reflecting the network behavior function of the rebounding Trojan horse control terminal. The invention can safely and effectively rebuild the important function of the network behavior of the rebound Trojan horse control terminal.

Description

technical field [0001] The invention relates to the technical field of Trojan horses, in particular to the technical field of control and analysis of Trojan horses, in particular to a method and system for rebuilding network behavior functions of a control terminal of a rebounding Trojan horse. Background technique [0002] A rebound Trojan is a service program that resides in the user's computer, while the attacker controls the corresponding client program. The service program opens the connection resources of the user's computer through a specific port. Once the client program mastered by the attacker sends a request, the rebounding Trojan will connect with him and steal the user's information. [0003] After analyzing the characteristics of the firewall, the rebound port Trojan found that: the firewall often performs very strict filtering on incoming links, but neglects to prevent outgoing links. Therefore, contrary to general Trojan horses, the server (controlled end) ...

AI Technical Summary

Problems solved by technology

[0006] In view of the shortcomings of the prior art described above, the purpose of the present invention is to provide a method and system for rebuilding the network behavior function of the rebounding Trojan horse control terminal, which is used to solve the problems of difficult analysis and high risk in the analysis of the rebounding Trojan horse program in the prior art. question

Images