A Trojan Horse Detection Method Based on Extended Attack Tree Model

Abstract

Aiming at the problems in the prior art, such as insufficient feature expression, high false negative rate and false positive rate, unreasonable setting of attack tree node weights, etc., the invention proposes a Trojan horse detection method based on an extended attack tree model. The method comprises: obtaining an OPCode sequence by performing static feature analysis on the Trojan horse program, and extracting a Trojan horse characteristic OPCode short sequence from the OPCode sequence; by performing dynamic feature analysis on the Trojan horse program, obtaining an API call sequence, and extracting the short sequence of the Trojan horse feature OPCode from the OPCode sequence; Extract the Trojan horse feature API short sequence from the above API call sequence; construct the original extended attack tree according to the described OPCode short sequence and API short sequence, and initialize the weight parameters of the nodes of the original extended attack tree as the first basic attack tree A learner; dynamically updating the weight parameters to obtain several attack tree basic learners, constructing a strong learner through integrated learning, and performing Trojan horse detection.

Description

technical field [0001] The invention relates to a Trojan horse detection method based on an expanded attack tree model, which belongs to the field of network security. Background technique [0002] Currently Trojan detection technology mainly includes behavior analysis technology, virtual machine technology, feature code scanning technology and real-time monitoring technology. Wherein, the behavior analysis technology refers to obtaining its behavior characteristics by analyzing the malicious Trojan horse program, or monitoring its behavior characteristics when executing the program, and judging whether it is a malicious program according to the suspiciousness of the characteristics; the virtual machine technology refers to the construction A completely isolated, virtual operating environment, allowing malicious Trojan horse programs to run in this virtual environment, and record their operating characteristics, and finally judge whether it is a Trojan horse according to its...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the problems in the prior art, such as insufficient feature expression, high false negative rate and false negative rate, unreasonable setting of attack tree node weights, etc., the present invention proposes a Trojan horse detection method based on an expanded attack tree model

Images