Device and method for detecting Trojan horse remote shell behavior

Abstract

The invention discloses a Trojan horse remote shell behavior detection device and method. The detection device includes a data packet collection device, a data flow screening and filtering device, a data flow characteristic extraction device and a Trojan horse shell behavior characteristic detection device. The detection method is first to obtain real-time network traffic data at the network entrance; then classify the real-time network traffic data to filter out irrelevant protocol data streams; and then extract the load ratio of incoming and outgoing packets and the ratio of the number of incoming and outgoing packets in the response process of each data flow , data flow response interval; finally, the data flow features extracted within a certain time interval are constructed into feature vectors and input to the constructed neural network model; finally, the results are calculated through the neural network model to determine whether there is a Trojan remote shell in the data flow Behavior, and output the results, and feed back the detection results to the data stream filtering, which is suitable for large-scale network environments and can detect known and unknown Trojan horse remote shell behaviors.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a Trojan horse remote shell behavior detection device and method. Background technique [0002] In recent years, the issue of network security has become one of the key issues of concern in various countries. With the exposure of the "Prism" incident, the issue of network privacy and individual users' online security has once again become the focus of public attention. With the continuous development of network attack technology, various new Trojan horse technologies continue to emerge. Although major security vendors are also advancing with the times and continuously launching security products using new technologies, the security problem is still serious. [0003] With the development of the times, the probability of the outbreak of network viruses and Trojan horses in the past is getting smaller and smaller. Cyber ​​attackers have gone underground and developed a comple...

AI Technical Summary

Problems solved by technology

This method has a certain ability to detect unknown Trojan horses, but in essence it is still a detection method based on Trojan horse signatures, and the detection false positive rate for new Trojan horses is relatively high

At the same time, this detection method cannot detect the Trojan shell behavior

Images