System and method for detection of Trojan horse return link based on six-dimensional spatial traffic analysis model

Abstract

The invention provides a six-dimensional space flow analysis model based hobbyhorse reconnection detection system and method. Flow data are expanded and enlarged, and data of six-dimensional space and23 tuples are adopted for observation of hobbyhorse reconnection flow which uses a DGA algorithm, so that a more efficient and more accurate detection method is obtained. A modeling and statistical detection method rather than a traditional fixed characteristic identification way is adopted by the six-dimensional space flow analysis model based hobbyhorse reconnection detection system and method;maintenance of a huge characteristic library is no longer necessary, and the hobbyhorse reconnection flow using the DGA algorithm can be detected efficiently and accurately. Flow characteristics aredispersed to the 23 tuples, each partial characteristic of the flow is represented through a six-dimensional space model, and more comprehensive analysis on the flow can be realized efficiently through the model; and furthermore, the six-dimensional space flow analysis model based hobbyhorse reconnection detection system and method can trace malicious behaviors.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a system and method for detecting Trojan horse links based on a six-dimensional spatial flow analysis model. Background technique [0002] Most of the early Trojan horse connection traffic detection technologies were based on fixed features. This is mainly because many of the early Trojan horse connection addresses were encrypted or unencrypted and hard-coded in malicious samples. Therefore, through sample analysis, extract By adding its callback address to the feature database, the callback behavior of the infected terminal can be detected, so as to accurately locate the infected terminal and realize security protection. [0003] In order to evade this type of security detection, attackers created the DGA algorithm. The DGA (Domain Generation Algorithm) algorithm, also known as the domain name generation algorithm, is often used in Botnet. Malicious code uses a pri...

AI Technical Summary

Problems solved by technology

For this type of samples, the feature detection method based on the traditional seven-tuple model cannot achieve security protection

Images