Method and system for preventing remote control type Trojan viruses

Abstract

The invention provides a method and system for preventing remote control type Trojan viruses. The method includes the steps of capturing data packet flow in a network, traversing the captured data packet flow through the characteristics in a preset characteristic rule base, judging whether matching characteristics exist or not, handing over the data packet flow to a subsequent malicious code probe to be processed if the matching characteristics exist, continuing judging the data packet flow if no matching characteristics exist, removing a known URL in the captured data packet flow, judging whether the data packet flow is malicious flow or not, conducting stopping and giving an alarm and a prompt if the data packet flow is malicious flow, and releasing the data packet flow if the data packet flow is not malicious flow. The invention further provides the corresponding system. By means of the method and the system, the remote control type Trojan viruses can be effectively prevented from running, malicious flow can be prevented from in and out, and a computer of a user is protected against damage.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for preventing remote control Trojan horse viruses. Background technique [0002] In the field of network security, the main purpose of computer viruses is to destroy system equipment, while Trojan horses are more inclined to steal confidential information. The remote control program is a kind of Trojan horse. Once used by criminals, it will be used to steal confidential documents, causing information leakage and immeasurable losses. [0003] Remote control is a means of operating a computer. Through the remote control program, the various resources of the controlled terminal are controlled accordingly, which is essentially the same as the local operation. The remote controler usually has a higher level of execution of the system. permission. The remote control program consists of two parts: one part is the client program (Client) used to send comma...

AI Technical Summary

Problems solved by technology

[0005] At present, the detection technology for remote control Trojans can be roughly divided into three categories: one is to analyze from the stage of Trojan implantation, which has a single function and is prone to false positives and false positives; Detection, the recognition rate of this method is low, and it cannot be detected when the Trojan horse changes its initial state; the third type is to detect from the Trojan horse communication process, this detection method has a certain lag, and the remote control Trojan horse is implanted into the target system. The communication port can be changed during operation, control, etc., so as to avoid being recognized by this method

Images