Device and method for detecting trojan remote shell behavior

Abstract

The invention discloses a device and a method for detecting a trojan remote shell behavior. The device comprises a packet acquiring device, a data stream selecting and filtering device, a data stream character extracting device and a trojan shell behavior character detecting device. The detecting method comprises the following steps of firstly acquiring real-time network flow data of an internet access; then classifying data stream of the real-time network flow data, and filtering irrelevant protocol data stream; extracting an inlet and outlet packet load ratio, an inlet and outlet packet number ratio and a data stream answering interval in an answering and response process in each data stream; forming data stream characters extracted within certain time interval into a character vector, and inputting the character vector into a formed neural network model; finally calculating a result through the neural network model, judging whether the trojan remote shell behavior exists in the data stream or not, outputting the result, and feeding the detection result back to the data stream selecting and filtering device. The device and the method are applied to a large-scale network environment and can detect known and unknown trojan remote shell behaviors.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a Trojan horse remote shell behavior detection device and method. Background technique [0002] In recent years, the issue of network security has become one of the key issues of concern in various countries. With the exposure of the "Prism" incident, the issue of network privacy and individual users' online security has once again become the focus of public attention. With the continuous development of network attack technology, various new Trojan horse technologies continue to emerge. Although major security vendors are also advancing with the times and continuously launching security products using new technologies, the security problem is still serious. [0003] With the development of the times, the probability of the outbreak of network viruses and Trojan horses in the past is getting smaller and smaller. Cyber ​​attackers have gone underground and developed a compl...

AI Technical Summary

Problems solved by technology

This method has a certain ability to detect unknown Trojan horses, but in essence it is still a detection method based on Trojan horse signatures, and the detection false positive rate for new Trojan horses is relatively high

At the same time, this detection method cannot detect the Trojan shell behavior

Images