An Efficient Remote Control Trojan Horse Detection Method

Abstract

The invention discloses a high-efficiency remote control Trojan detection method. Whether remote control Trojan exists in a network is judged through network behavior characteristics. The method can be applied to actual network traffic detection, and the false alarm rate is close to 0. The whole method comprises the following stages: in a first stage, traffic is collected; in a second stage, behavior characteristics are extracted; in a third stage, the method is realized: in combination of SMOTE over sampling and XGBoost classification methods, the SMOTE over sampling algorithm solves the unbalanced dataset classification problem at a data layer, the emerging high-precision classification algorithm XGBoost classification method in a machine learning field is firstly applied to Trojan detection, while the high accuracy is achieved, the unbalanced dataset classification problem at an algorithm layer is solved; and in a fourth stage, the method is optimized and evaluated. The method pays attention to law discovery through mining of a network mixed traffic, and the method is suitable for completing recognition on known Trojan and also detecting unknown remote control Trojan.

Description

technical field [0001] The invention belongs to the field of information technology, and in particular relates to an efficient remote control Trojan horse detection method. Accurate detection of known remote control Trojans in mixed traffic, as well as identification of unknown remote control Trojans, is of great significance for maintaining network security and reducing losses of the country, enterprises and individuals. Background technique [0002] In recent years, remote control Trojan horses have been continuously used by attackers for remote control and information theft, which has posed a serious threat to network security and caused serious impact and huge losses to the country, enterprises and individuals. The remote control Trojan horse consists of two parts: the control end (client) and the controlled end (server). Usually, attackers use spear phishing and social engineering attacks to find machines that can be infected, and then use standard TCP / IP or UDP protoc...

AI Technical Summary

Problems solved by technology

[0006] People such as Shicong Li realized the detection of Trojan horses through clustering algorithm. This algorithm selected the characteristics of network layer and IP layer, and completed the detection method of mixed traffic. However, the features selected by this method are applied to the detection of remote control Trojan horses and cannot not necessarily effective

Images