Mining Trojan horse detection method and device

Abstract

The invention discloses a mining Trojan horse detection method and device, relates to the technical field of network security, and aims to effectively detect whether a mining Trojan horse program is implanted into terminal equipment. The method comprises the following steps: receiving user behavior logs uploaded by a plurality of clients; matching each command line with a preset rule so as to extract keywords contained in each command line from each command line; performing statistical processing on the plurality of keywords to determine high-risk keywords; when a to-be-detected user behaviorlog is received, matching a plurality of to-be-detected command lines contained in the to-be-detected user behavior log with a preset rule so as to extract to-be-detected keywords contained in each to-be-detected command line from each to-be-detected command line; when it is judged that the to-be-detected keyword is the high-risk keyword, determining the to-be-detected command line where the to-be-detected keyword is located as a mining Trojan horse command line. The method and the device are suitable for the process of detecting whether the mining Trojan horse program is implanted into the terminal equipment.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting a mining Trojan. Background technique [0002] With the continuous development of blockchain technology, digital encrypted currency with advantages such as high security and transparent transaction process is widely used in the financial field. However, the issuance of digital encrypted currency directly leads to the birth of mining Trojans, and more and more Many lawbreakers have begun to earn illegal profits through mining Trojan horse programs: because digital encrypted currency is obtained by computers and other terminal equipment through a large number of calculations based on specific algorithms, when criminals implant mining Trojan horse programs into After entering the victim's terminal device, criminals can use the victim's terminal device to mine, thereby earning illegal profits. Therefore, how to effectively detect and remove...

AI Technical Summary

Problems solved by technology

[0003] At present, when detecting whether a mining Trojan program is implanted in a terminal device, the antivirus software client is usually used for static detection or dynamic detection. Update the mining Trojan horse program, which makes the existing mining Trojan horse detection method lag, which makes it impossible to effectively detect whether the mining Trojan horse program is implanted in the terminal device through the anti-virus software client

Images