A kind of method and device for identifying Trojan horse virus

Abstract

The invention discloses a method and apparatus for identifying Trojan virus. The method comprises the following steps: collecting core network data and charging data, wherein the core network data comprise signaling data and service data; performing historical habit analysis and periodic behavior analysis on periodic service data, and identifying a suspected infected user in combination with the charging data; when it is judged that the service information corresponding to the service data does not belong to a white list library and belongs to a blacklist library, adding the service data to a suspected Trojan behavior event list; when it is judged that the service information corresponding to the service data does not belong to the white list library and does not belong to the blacklist library, adding the service data satisfying a screening strategy to the suspected Trojan behavior event list; and performing centralized analysis on the service data in the suspected Trojan behavior event list, determining the service data belonging to the Trojan, and adding the service information of the service data belonging to the Trojan to the blacklist library.

Description

technical field [0001] The invention relates to the field of mobile communication, in particular to a method and device for identifying mobile phone Trojan horse viruses through user behavior on the network. Background technique [0002] With the development of the mobile Internet and the popularization of mobile terminals, especially smart terminals, mobile phone viruses or malicious programs on mobile phones are about to cause a lot of harm. Among all virus types, Trojan horse viruses for the purpose of consuming tariffs, stealing user identity information, transaction information, and payment information account for more than 75%, becoming the most important aspect affecting user information security and economic security. [0003] Mobile phone viruses originated from computer viruses. Following the definition of computer Trojan horses, mobile phone Trojan horses can be defined as: Trojan horses are hidden and spontaneous programs that can be used to perform malicious ac...

AI Technical Summary

Problems solved by technology

[0008] 2. Steal user information and carry out extortion and deception

[0009] 3. Illegal customization of various service provider (sp, service provider) services

The harm caused by mobile phone Trojan horses, such as charging fees and consuming traffic, will generally cause adverse effects on operators indirectly through user complaints and off-network

If the operator cannot find out the reason in time, it needs to compensate the user's complaint about the loss of tariff, resulting in the loss of economy and brand satisfaction

For such problems, existing solutions are more difficult to solve

Images