A method for detecting network traffic of rebound type remote control Trojan based on behavior analysis

Abstract

The invention discloses a rebound type remote control Trojan network flow detection method based on behavior analysis. Firstly, after performing TCP session reorganization, session feature extraction and session marking on training samples, the session features and session marking are input into a random forest detection model. By comparing the index performance of the model under different parameters, adjust the model, and finally determine the optimized Trojan horse detection model. Then, TCP session reorganization and session feature extraction are performed on the real-time raw traffic data collected on the probe, and the session features are input into the Trojan horse detection model optimized in the first stage, and the model classifies it as Trojan horse traffic or normal business traffic. The technical effect of the present invention is that, starting from the traffic characteristics produced by the Trojan horse's own characteristics, the traffic files are directly detected through the model, so the present invention does not rely on the existing Trojan horse feature library, and can also detect unknown new remote control Trojan horses. Trojans that encrypt communication traffic can be detected.

Description

technical field [0001] The invention relates to the field of network security, in particular to a behavior analysis-based rebound type remote control Trojan network traffic detection method. Background technique [0002] Because hackers can remotely control Trojan horses to steal corporate sensitive data, monitor key user behaviors, and perform malicious operations, remote control Trojan horses have become one of the important information security threats faced by enterprises. The remote control Trojan horse program is composed of two independent parts - the control terminal and the controlled terminal. These two parts exchange data through the Internet. The controlled program is secretly installed on the infected computer through phishing emails or USB flash drives, and receives commands from hackers remotely. The control program is mastered by hackers and sends commands to the infected computer. Remote control Trojans can be divided into two categories according to the c...

AI Technical Summary

Problems solved by technology

[0004] From the perspective of network behavior analysis, there must be differences between rebounding remote-control Trojans and normal business behaviors. However, there is no public literature that proposes a method that can intelligently analyze network behavior and efficiently and accurately detect rebounding remote-control Trojans. Network traffic

Images