Trojan horse communication feature fast extraction method based on clustering analysis of multiple data streams

Abstract

The invention discloses a Trojan horse communication feature fast extraction method based on network data stream clustering. The method comprises the steps that firstly, a captured network data packet is sorted according to a network conversation, wherein an IP address and a port of a monitoring object serve as a source IP address and a source port, and the data packet is subjected to conversation division according to equivalent tetrads; secondly, data streams are clustered into data stream clusters through a data stream clustering algorithm based on timestamps; lastly, Trojan horse communication features are extracted, wherein the Trojan horse communication features are extracted at the Trojan horse interactive operation stage. According to the Trojan horse communication feature fast extraction method, on the basis of network data stream clustering, the network data streams are processed with clusters as units, the difference between a Trojan horse communication behavior and a normal network communication behavior is analyzed, the difference between the two behaviors is dug deeply and the network communication features are extracted in combination with traditional statistic analysis, correlation analysis and other technologies, the false alarm rate is lowered while the detection rate is guaranteed, and the Trojan horse communication feature fast extraction method can be used for detecting a secret stealing behavior in a network.

Description

technical field [0001] The invention relates to a method for extracting communication features of a Trojan horse, in particular to a method for quickly extracting communication features of a Trojan horse based on cluster analysis of multiple data streams. Background technique [0002] In recent years, Trojan horse programs have been used by network hackers to carry out more and more acts of information theft and network destruction, posing a serious threat to the information security of users and networks. The biggest characteristic of the Trojan horse is that its behavior often has strong concealment. After the Trojan horse is successfully implanted into the target computer, the Trojan horse control terminal must communicate with the controlled terminal, so as to issue control instructions to the controlled terminal or control the controlled terminal to return the obtained information to the control terminal. The detection technology based on the analysis of communication ...

AI Technical Summary

Problems solved by technology

The detection method proposed in this study can effectively detect real-time data streams, but it also has certain shortcomings. The detection method is still based on the analysis of a single data stream, and the accuracy is low.

Images