Self-adaptive trojan communication behavior detection method on basis of dynamic feedback

Abstract

The invention discloses a self-adaptive trojan communication behavior detection method on the basis of dynamic feedback, which comprises the steps of processing trojan detection alarm information, constructing a sample set for dynamic feedback learning by utilizing the alarm information, and determining updating opportunity of detection by detecting concept drift of a data stream, wherein the step of processing the trojan detection alarm information comprises the sub-steps of carrying out merging and association processing on the alarm information which is subjected to standard description, then establishing an intrusion track event and storing the intrusion track event into an intrusion event table. According to the invention, aiming at the problem of self-adaption of information stealing trojan detection, the information stealing trojan detection alarm information is analyzed, methods of similarity analysis, clustering analysis and the like are combined, related information of a target IP (Internet Protocol) is acquired additionally by driving detection, the sample set for dynamic feedback learning is constructed by the alarm information, an increment support vector machine algorithm is used as an algorithm for dynamic feedback learning, and the updating opportunity of a detection system is determined by detecting the concept drift of the data stream.

Description

Technical field: [0001] The invention relates to a detection method of Trojan horse communication behavior, in particular to an adaptive detection method of Trojan horse communication behavior based on dynamic feedback. Background technique: [0002] At present, the existing secret-stealing Trojan detection technology mainly adopts signature matching technology. Compared with the detection technology based on signature matching, the detection technology based on communication behavior feature analysis has obvious advantages in accuracy and scalability, which is conducive to discovering potential and unknown network stealing behaviors and threats, and has a wider application prospect . Existing detection methods for stealing Trojan horses based on statistical analysis of network communication data usually establish a binary classification static detection model based on collected samples and normal network behavior data, and then use the model to judge and predict actual net...

AI Technical Summary

Problems solved by technology

The detection method proposed in this study can effectively detect real-time data streams, but it also has certain shortcomings. The detection method does not have the ability of self-adaptation, and the analysis time is short, which may fail for high-concealment Trojan horses.

Images