A Trojan Horse Detection Method Based on Computer Memory Analysis Technology

Abstract

The Trojan horse detection method based on computer memory analysis technology of the present invention includes behavior monitoring, malicious code detection, comprehensive analysis of disk information, comprehensive correlation analysis, and detection result presentation; behavior monitoring includes process operation, registry operation, file operation and network data monitoring , Malicious code detection includes dynamic link library detection, malicious process, hidden process detection, driver detection, comprehensive analysis of disk information includes registry startup items, file scanning, and PE file analysis. In the Trojan horse detection method of the present invention, for malicious codes protected by encryption, the state of the malicious codes in the memory is decrypted, and the detection of such malicious codes using the technology does not need to be decrypted, the detection results are more reliable, and rootkit attacks can be effectively prevented Impact on Trojan detection results.

Description

technical field [0001] The present invention relates to a method for detecting a Trojan horse, more specifically, to a method for detecting a Trojan horse based on computer memory analysis technology. This method will be applied in the field of information security, mainly for the detection of information security incidents and various computer attack incidents. Background technique [0002] a). Trojan horse; [0003] The name comes from the "Trojan horse" in ancient Greek mythology, because this type of malicious program, like the Trojan horse, is characterized by strong concealment and is not easy to be found. Here it specifically refers to a type of spy code that lurks after entering the host computer and sends information about the host computer to the Trojan horse operator. Once entering the computer, the Trojan horse program will actively search for system resources, obtain necessary legal conditions for existence, or avoid being captured and killed. After that, the ...

AI Technical Summary

Problems solved by technology

[0024] With the continuous development and maturity of malicious code detection technology, many malicious code detection methods have emerged. However, these methods have their limitations in the detection of special Trojans: signature scanning and broad-spectrum feature methods are difficult to find unknown malicious code. ; The heuristic method has a high false positive rate and is difficult to apply; the sandbox method is easily detected and circumvented by malicious code; the full traffic analysis method is difficult to detect unknown Trojans encrypted by communication

Images