Trojan detection method and device

Abstract

The present invention provides a Trojan detection method, which can be applied to the field of computer technology, and specifically relates to technical fields such as power systems, information security, and network security. The Trojan detection method includes: inputting a business data set to be detected into a state detection model, and outputting a model detection result; when it is determined that the model detection result indicates that the target business system is abnormal, matching the business data set to be detected with a preset detection rule to obtain a rule detection result; when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, using a triangular fuzzy algorithm to process the business data set to be detected, and obtaining a fuzzy ideal solution that matches the business data set to be detected; and determining the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution. The present invention also provides a Trojan detection device.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, specifically to technical fields such as power systems, information security, and network security, and more specifically to a Trojan detection method and device. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent. Trojans, as a common type of malware, often lurk in computer systems, stealing user data, destroying system integrity, and even performing illegal operations. Therefore, effective detection and prevention of Trojans has become an important task in the current field of network security.

[0003] Traditional Trojan detection technology requires a lot of hardware resources, which greatly affects normal business operations. In addition, Trojans are extremely hidden in computer systems, making accurate detection of Trojans more difficult. Summary of the invention

[0004] In view of the above problems, the present invention provides a Trojan detection method and device.

[0005] According to one aspect of the present invention, the present invention provides a Trojan detection method, comprising:

[0006] Inputting the business data set to be detected into the state detection model and outputting the model detection result, wherein the business data set to be detected represents the state data of the target business system in the process of processing the business;

[0007] When it is determined that the model detection result indicates that the target business system is abnormal, the business data set to be detected is matched with the preset detection rule to obtain the rule detection result;

[0008] In the case where it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, a triangular fuzzy algorithm is used to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected; and

[0009] Based on the above-mentioned business data set to be detected and the above-mentioned fuzzy ideal solution, the Trojan detection result of the above-mentioned target business system is determined.

[0010] According to an embodiment of the present invention, the above state detection model is obtained in the following manner:

[0011] Cluster the historical business data set to obtain multiple clusters;

[0012] Based on the above multiple clusters, the above historical business data set is screened to obtain a target historical business data set;

[0013] Labeling each historical business data in the target historical business data set with a predetermined label to obtain a training set; and

[0014] The support vector machine is trained using the above training set to obtain the above state detection model.

[0015] According to an embodiment of the present invention, the method further includes:

[0016] Comparing the above model detection result with a predetermined reference threshold to obtain a comparison result; and

[0017] Based on the comparison result, determine whether the model detection result indicates that the target business system is abnormal.

[0018] According to an embodiment of the present invention, the above-mentioned preset detection rules include Trojan startup rules, Trojan operation rules, and network signal rules;

[0019] The above-mentioned business data set to be detected is matched with the preset detection rules to obtain the rule detection results, including:

[0020] Matching the above-mentioned service data set to be detected with the startup data features contained in the above-mentioned Trojan startup rule to obtain a startup matching result, and determining the startup rule detection result based on the above-mentioned startup matching result and the above-mentioned Trojan startup rule;

[0021] Matching the above-mentioned business data set to be detected with the operation data features contained in the above-mentioned Trojan operation rules to obtain an operation matching result, and determining the operation rule detection result based on the above-mentioned operation matching result and the above-mentioned Trojan operation rules;

[0022] Matching the service data set to be detected with the network data features contained in the network signal rule to obtain a network matching result, and determining a network rule detection result based on the network matching result and the network signal rule; and

[0023] Based on the above startup rule detection result, the above operation rule detection result and the above network rule detection result, the above rule detection result is obtained.

[0024] According to an embodiment of the present invention, the rule detection result is obtained based on the startup rule detection result, the operation rule detection result and the network rule detection result, including:

[0025] In the case where it is determined that any one of the startup rule detection result, the operation rule detection result, and the network rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan, determining that the rule detection result indicates that the target business system has been implanted with the predetermined type of Trojan; and

[0026] When it is determined that the startup rule detection result, the operation rule detection result and the network rule detection result all indicate that the target business system has not been implanted with the predetermined type of Trojan, it is determined that the rule detection result indicates that the target business system has not been implanted with the predetermined type of Trojan.

[0027] According to an embodiment of the present invention, the above-mentioned fuzzy ideal solution includes a positive fuzzy ideal solution and a negative fuzzy ideal solution;

[0028] The above-mentioned service data set to be detected includes a plurality of service sub-data sets of different types, and each of the above-mentioned service sub-data sets includes a plurality of service sub-data sequences acquired in different time periods;

[0029] The above-mentioned determination of the Trojan detection result of the above-mentioned target business system based on the above-mentioned business data set to be detected and the above-mentioned fuzzy ideal solution includes:

[0030] Determine the triangular fuzzy number of each of the business sub-data sequences, wherein the triangular fuzzy number includes the maximum value, the minimum value and the target value in the business sub-data set;

[0031] Based on the subset fuzzy ideal solution of each of the business sub-data sets and the positive fuzzy ideal solution, determining a first distance between the business data set to be detected and the positive fuzzy ideal solution;

[0032] Determine a second distance between the service data set to be detected and the negative fuzzy ideal solution based on the subset fuzzy ideal solution of each service sub-data set and the negative fuzzy ideal solution; and

[0033] Based on the first distance and the second distance, a Trojan detection result of the target business system is determined.

[0034] According to an embodiment of the present invention, the above-mentioned processing of the above-mentioned service data set to be detected by using a triangular fuzzy algorithm to obtain a fuzzy ideal solution matching the above-mentioned service data set to be detected includes:

[0035] Determining a subset fuzzy ideal solution of each of the business sub-data sets based on the triangular fuzzy number of each of the business sub-data sequences, wherein the triangular fuzzy number includes a maximum value, a minimum value and a target value in the business sub-data sequence; and

[0036] According to the sorting method of approximating the ideal solution, the positive fuzzy ideal solution and the negative fuzzy ideal solution are determined based on each of the triangular fuzzy numbers and the weight matching each of the business sub-datasets.

[0037] According to an embodiment of the present invention, the determining of the triangular fuzzy number of each of the business sub-data sequences comprises:

[0038] In the case where it is determined that the data in the service sub-data sequence is of a non-numeric type, converting the data in the service sub-data sequence to obtain a service sub-data sequence of a numeric type; and

[0039] The maximum value, the minimum value and the target value are determined from the business sub-data sequence of the above numerical type to obtain the above triangular fuzzy number.

[0040] According to an embodiment of the present invention, the above-mentioned service data set to be detected is obtained in the following manner:

[0041] Obtaining a file operation data set within a preset period;

[0042] Obtaining a network communication data set within a preset time period;

[0043] Obtaining a program running data set within a preset period; and

[0044] Based on the file operation data set, the network communication data set and the program operation data set, the to-be-detected business data set is obtained.

[0045] According to another aspect of the present invention, there is provided a Trojan detection device, comprising:

[0046] A model detection module is used to input the business data set to be detected into the state detection model and output the model detection result, wherein the business data set to be detected represents the state data of the target business system in the process of processing the business;

[0047] A rule detection module is used to match the business data set to be detected with a preset detection rule to obtain a rule detection result when it is determined that the model detection result indicates that the target business system is abnormal;

[0048] an ideal solution determination module, for, when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, using a triangular fuzzy algorithm to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected; and

[0049] The Trojan detection module is used to determine the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution.

[0050] The Trojan detection method provided by the embodiment of the present invention can process the business data set to be detected by using a triangular fuzzy algorithm to obtain a fuzzy ideal solution that matches the business data set to be detected, when the state detection model determines that the target business system is abnormal, and the preset detection rules determine that the target business system is not implanted with a predetermined type of Trojan. Based on the business data set to be detected and the fuzzy ideal solution, the Trojan detection result of the target business system is determined, thereby improving the processing accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0052] Figure 1 A diagram showing an application scenario of a Trojan detection method and device according to an embodiment of the present invention;

[0053] Figure 2 A flowchart of a Trojan detection method according to an embodiment of the present invention is shown;

[0054] Figure 3 A flowchart of a Trojan detection method according to another embodiment of the present invention is shown;

[0055] Figure 4 A structural block diagram of a Trojan detection device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0056] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0057] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0058] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0059] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0060] An embodiment of the present invention provides a Trojan detection method, including: inputting a business data set to be detected into a state detection model and outputting a model detection result; when it is determined that the model detection result indicates that the target business system is in an abnormal state, matching the business data set to be detected with a preset detection rule to obtain a rule detection result; when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, using a triangular fuzzy algorithm to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected; and determining the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution.

[0061] Figure 1 An application scenario diagram of a Trojan detection method according to an embodiment of the present invention is shown.

[0062] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0063] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0064] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0065] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0066] It should be noted that the Trojan detection method provided in the embodiment of the present invention can generally be executed by the server 105. Accordingly, the Trojan detection device provided in the embodiment of the present invention can generally be set in the server 105. The Trojan detection method provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the Trojan detection device provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0067] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only . According to the implementation requirements, there can be any number of terminal devices, networks and servers.

[0068] The following will be based on Figure 1 The scene described by Figure 2~Figure 3 The Trojan detection method of the disclosed embodiment is described in detail.

[0069] Figure 2 A flow chart of a Trojan detection method according to an embodiment of the present invention is shown.

[0070] like Figure 2 As shown, the Trojan detection method of this embodiment includes operations S210 to S240, and the Trojan detection method can be executed by a server or a terminal device.

[0071] In operation S210, the service data set to be detected is input into the state detection model, and the model detection result is output.

[0072] In operation S220, when it is determined that the model detection result indicates that the target business system is abnormal, the business data set to be detected is matched with the preset detection rule to obtain a rule detection result.

[0073] In operation S230, when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, a triangular fuzzy algorithm is used to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected.

[0074] In operation S240 , a Trojan detection result of the target business system is determined based on the business data set to be detected and the fuzzy ideal solution.

[0075] According to an embodiment of the present invention, the target business system may include a power system, but is not limited thereto, as long as it is an operating system that can be used to process business.

[0076] According to an embodiment of the present invention, the business data set to be detected represents the state data of the target business system in the process of processing the business. For example, it may include the operation data of important files, such as the operation data of copying or reading important files. It may also include object behavior data related to system processes or business processes, such as time data related to related processes, data of calling service functions, etc. It may also include data related to communication with a remote server or data related to communication traffic used for communication, such as communication protocol, traffic size, etc.

[0077] According to an embodiment of the present invention, the state detection model may include but is not limited to a convolutional neural network, a support vector machine, a recurrent neural network, etc. Any model can be used as long as it uses the service data set to be detected as input data and uses the model detection result representing whether the target service system is abnormal as output data.

[0078] According to an embodiment of the present invention, when it is determined that the model detection result indicates that the target business system is normal, the subsequent operations S220 to S240 can be stopped. When it is determined that the model detection result indicates that the target business system is abnormal, operations S220 to S240 are performed. This improves the detection accuracy and processing efficiency.

[0079] According to an embodiment of the present invention, the preset detection rule may be obtained by summarizing actual experience. The preset detection rule may include, but is not limited to, multiple reference business data sets of different types and results corresponding to the multiple reference business data sets, which characterize the business system being implanted with a Trojan, and the result may also include the Trojan type.

[0080] According to an embodiment of the present invention, the business data set to be detected is matched with the preset detection rules. When the business data set to be detected matches one of the reference business data sets, the rule detection result may include a result that a predetermined type of Trojan is implanted corresponding to the reference business data set. When the business data set to be detected does not match any of the reference business data sets, the rule detection result may include a result that the target business system is not implanted with a predetermined type of Trojan.

[0081] According to an embodiment of the present invention, operations S230 and S240 may be performed when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan. When it is determined that the rule detection result indicates that the target business system is implanted with a predetermined type of Trojan, subsequent operations are stopped.

[0082] According to an embodiment of the present invention, when the target business system is determined to be abnormal through the state detection model, and the target business system is determined to be not implanted with a predetermined type of Trojan by using the preset detection rules, the triangular fuzzy algorithm can be used to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected. Based on the business data set to be detected and the fuzzy ideal solution, the Trojan detection result of the target business system is determined. This improves the processing accuracy.

[0083] The Trojan detection method provided by the embodiment of the present invention combines multiple detection means such as model detection, rule matching detection algorithm and triangular fuzzy algorithm. The state detection model can also be called a business access feature baseline model. The state detection model can detect whether the state of the target business system is normal or not by analyzing the difference between the normal business access features of the target business system and the Trojan access features. The core idea of ​​this technology is to use a machine learning algorithm to monitor the access behavior of the target business system in real time and extract access features. The access features monitored in real time are compared with the business access feature baseline, that is, the normal state features. If there is a significant difference, it is judged that the target business system is in an abnormal state and may be implanted with a Trojan. In addition, the present invention also introduces rule detection and triangular fuzzy algorithm detection to perform dynamic behavior analysis on the process suspected of having a Trojan, and further verify whether it is implanted with a predetermined type of Trojan. If it is confirmed to be a predetermined type of Trojan, isolation, removal and other disposal measures can be taken in a manner that matches the predetermined type of Trojan to ensure system security.

[0084] In summary, the Trojan detection method provided by the embodiment of the present invention can effectively improve network security protection capabilities and reduce the risks caused by Trojans to target business systems. At the same time, it can also be applied to other fields, such as cloud computing, big data, etc., and has broad application prospects.

[0085] The Trojan detection method provided by the embodiment of the present invention has at least one of the following effects: 1. High accuracy: by analyzing the difference between business access characteristics and Trojan access characteristics, the detection accuracy is improved; 2. Strong real-time performance: real-time monitoring of the status data of the target business system in the process of processing business, and timely discovery of Trojan detection results; 3. High degree of automation: using machine learning algorithms and computer technologies such as triangular fuzzy algorithms and rule matching algorithms, automatic detection and processing are achieved; 4. Small business impact: low false alarm rate, and little impact on the target business system processing business.

[0086] According to an embodiment of the present invention, the service data set to be detected is obtained in the following manner:

[0087] Obtain a file operation data set within a preset period. Obtain a network communication data set within a preset period. Obtain a program operation data set within a preset period. Based on the file operation data set, the network communication data set and the program operation data set, obtain the service data set to be detected.

[0088] According to an embodiment of the present invention, relevant data within a preset period can be collected by installing a behavior monitoring module in the target business system. The behavior monitoring module can include a file monitoring module, a process monitoring module and a network communication monitoring module to collect data on the business operation process.

[0089] The file monitoring module mainly monitors key files that may be operated by Trojans through the file system micro-filter (FS Mini-Filter) technology, such as important system registry files, DLL (Dynamic Link Library) files, and more important files in business processes.

[0090] The process monitoring module mainly monitors at the thread or process level through the system service hook (SSDT Hook) technology, and mainly collects the behaviors of related objects such as system processes, business processes, and other processes that may be hidden by key Trojans, such as the read and write operations of related processes, related time data, and data on calling system service functions.

[0091] The network communication module is a relatively important module in Trojan detection technology. It obtains communication traffic related data between related devices and remote servers or used for communication, such as communication protocols, traffic size, etc. through network transport layer filtering technology.

[0092] According to an embodiment of the present invention, at least one of a file operation data set, a network communication data set, and a program running data set can be used as a business data set to be detected. By collecting the business data set to be detected in the above manner, the data types of the data to be detected are rich and diverse, and comprehensive, thereby improving the accuracy of Trojan detection using reference data.

[0093] According to an embodiment of the present invention, the state detection model is obtained in the following manner:

[0094] The historical business data set is clustered to obtain multiple clusters. Based on the multiple clusters, the historical business data set is screened to obtain a target historical business data set. Each historical business data in the target historical business data set is labeled with a predetermined label to obtain a training set. The training set is used to train a support vector machine to obtain a state detection model.

[0095] According to an embodiment of the present invention, the historical business data set may be data generated by the target business system in the process of processing historical business. The historical state data representing the target business system in the process of processing historical business. Cluster analysis is performed on the historical business data set, and clusters with more data and closer distance are used as training data for building a baseline model of business access characteristics. The training data is used to train a support vector machine to obtain a state monitoring model.

[0096] According to an embodiment of the present invention, clustering the historical business data set to obtain multiple clusters may include the following steps:

[0097] Use the K-means clustering algorithm to perform cluster analysis on historical business data sets.

[0098] Specifically, the file operation data set, network communication data set and program running data set in the historical business data set are clustered respectively. The file operation data set mainly includes the collected data size of key files, typical code segments and other data. The program running data set includes the data of monitored key processes calling system service functions. The network communication data set includes the traffic data in the connection initiated in the TCP or UDP security network protocol.

[0099] For the above three types of data sets, randomly select K1, K2, and K3 objects as the initial cluster centers, calculate the distance between each object and each seed cluster center, and assign each object to the cluster center closest to it. The cluster centers and the objects assigned to them represent a cluster.

[0100] The above operation is repeated until the cluster center does not change any more, for example, the error sum of squares reaches a local minimum.

[0101] According to an embodiment of the present invention, the technical principle is that normal business process operations should account for a large proportion of the overall historical business data set, and the remaining historical business data with a small proportion should be redundant data or abnormal behavior data, and there is a large difference between normal business behavior data and abnormal behavior data or redundant data. The larger dense clusters with a large number of contents and small intra-group distances obtained after clustering are used as training data sets, and the labels represent normal states. The more dispersed clusters with smaller data volumes and longer intra-group distances are deleted.

[0102] According to the embodiment of the present invention, the clustered clusters are used as training sets and input into the support vector machine for supervised training. The support vector machine has application advantages in solving nonlinear problems and has good solving capabilities for the variable and complex characteristics of Trojan horse behaviors. The support vector machine can establish a binary relationship between normal behavior and normal data, and can effectively build a baseline model of normal business access characteristics through data obtained during normal business application processes.

[0103] According to an embodiment of the present invention, when executing Figure 2 After operation S210, the Trojan detection method may further include: comparing the model detection result with a predetermined reference threshold to obtain a comparison result. Based on the comparison result, determining whether the model detection result indicates that the target business system is abnormal.

[0104] The principle of using the state detection model is to solve and determine whether the data represents Trojan behavior through a binary classification algorithm, thereby realizing Trojan detection. After model detection, a probability of whether the data is a Trojan will be returned, with a value between 0 and 1. Since the normal data base used when building the model is large, the default preset benchmark threshold can be 0.8. Compare the model detection result with the preset benchmark threshold. If it is lower than the preset benchmark threshold, it means that the data set to be detected collected this time represents the target business system normally. Otherwise, it is determined that the target business system is abnormal. For example, erroneous data, redundant data or malicious data generated during the operation of the equipment can be preliminarily screened out through the state detection model. Other data that does not belong to the normal data category.

[0105] According to an embodiment of the present invention, screening by a status detection model can ensure that all normal data is released without affecting normal business operations, and further detection is performed on other anomalies or errors, thereby reducing the amount of data to be subsequently processed and improving detection accuracy.

[0106] According to an embodiment of the present invention, the preset detection rules may include Trojan startup rules, Trojan operation rules, and network signal rules.

[0107] According to an embodiment of the present invention, the service data set to be detected is matched with a preset detection rule to obtain a rule detection result, including:

[0108] Matching the service data set to be detected with the startup data features contained in the Trojan startup rule to obtain a startup matching result, and determining the startup rule detection result based on the startup matching result and the Trojan startup rule;

[0109] Matching the business data set to be detected with the operation data features contained in the Trojan operation rules to obtain the operation matching results, and determining the operation rule detection results based on the operation matching results and the Trojan operation rules;

[0110] Matching the service data set to be detected with the network data features contained in the network signal rule to obtain a network matching result, and determining a network rule detection result based on the network matching result and the network signal rule; and

[0111] Based on the startup rule detection result, the operation rule detection result and the network rule detection result, a rule detection result is obtained.

[0112] According to an embodiment of the present invention, based on the startup rule detection result, the operation rule detection result and the network rule detection result, the rule detection result is obtained, including: when it is determined that any one of the startup rule detection result, the operation rule detection result and the network rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan, it is determined that the rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan. When it is determined that the startup rule detection result, the operation rule detection result and the network rule detection result all indicate that the target business system has not been implanted with a predetermined type of Trojan, it is determined that the rule detection result indicates that the target business system has not been implanted with a predetermined type of Trojan.

[0113] According to an embodiment of the present invention, an abnormal behavior feature matching module can be established based on the startup features, hidden operation features and network connection features of the Trojan horse through the abnormal behavior feature input module. The abnormal behavior feature matching module will match the relevant file operations, transmission flow and other features of the Trojan horse, and if they match, an alarm will be issued, otherwise, subsequent operations will be performed.

[0114] Typical operations generated by known Trojans in computer systems, such as the modification of registry files by Trojans to avoid detection, typical code segments after obfuscating their own codes, hiding system processes, typical traffic when interacting with remote servers, and traffic interacting with other devices when spreading within the network, can all be used as preset abnormal behavior detection rules. The preset abnormal behavior characteristics should be typical, and it is necessary to ensure that they do not overlap with the behaviors generated during normal business process operations and do not affect the normal business operations.

[0115] In the matching process, the abnormal behavior feature rules can be used as the pattern string to be matched, and the data to be detected can be used as the text string for matching. By finding whether the pattern string exists in the text string, it is determined whether there is data that meets the abnormal behavior feature rules of the Trojan. Specifically, the KMP (an improved character matching algorithm) matching method can be used. The advantage of the KMP matching method over the string matching algorithm is that it can better utilize the information of the matching failure and reduce the complexity of the matching.

[0116] According to an embodiment of the present disclosure, matching the service data set to be detected with the startup data features contained in the Trojan startup rule to obtain a startup matching result may also include:

[0117] Perform feature extraction on the business data set to be detected to obtain a feature set to be detected;

[0118] The startup data features and the feature set to be detected are matched for feature similarity to obtain a startup matching result.

[0119] Based on the startup matching result and the Trojan startup rule, the startup rule detection result is determined, which may include:

[0120] The startup matching result is compared with the startup threshold contained in the Trojan startup rule to obtain the startup rule detection result.

[0121] For example, when the startup matching result is greater than the startup threshold, the startup rule detection result is characterized as a Trojan horse being implanted. When the startup matching result is less than or equal to the startup threshold, the startup rule detection result is characterized as a Trojan horse not being implanted.

[0122] According to an embodiment of the present disclosure, matching the service data set to be detected with the operation data features contained in the Trojan operation rules to obtain the operation matching result may also include:

[0123] Perform feature extraction on the business data set to be detected to obtain a feature set to be detected;

[0124] The running data features and the feature set to be detected are matched for feature similarity to obtain the running matching results.

[0125] Based on the operation matching result and the Trojan operation rule, the operation rule detection result is determined, which may include:

[0126] The operation matching result is compared with the operation threshold contained in the Trojan operation rule to obtain the operation rule detection result.

[0127] For example, when the operation matching result is greater than the operation threshold, the operation rule detection result is characterized as a Trojan horse being implanted. When the operation matching result is less than or equal to the operation threshold, the operation rule detection result is characterized as a Trojan horse not being implanted.

[0128] According to an embodiment of the present disclosure, matching the service data set to be detected with the network data features included in the network signal rule to obtain a network matching result may also include:

[0129] Perform feature extraction on the business data set to be detected to obtain a feature set to be detected;

[0130] The network data features and the feature set to be detected are matched for feature similarity to obtain the network matching results.

[0131] Based on the network matching results and the Trojan running rules, the network rule detection results are determined, which may include:

[0132] The network matching result is compared with the network threshold included in the network signal rule to obtain the network rule detection result. For example, if the network matching result is greater than the network threshold, the network rule detection result is characterized as a Trojan horse being implanted. If the network matching result is less than or equal to the network threshold, the network rule detection result is characterized as no Trojan horse being implanted.

[0133] According to an embodiment of the present invention, the fuzzy ideal solution includes a positive fuzzy ideal solution and a negative fuzzy ideal solution.

[0134] According to an embodiment of the present invention, the service data set to be detected includes multiple service sub-data sets of different types. Each service sub-data set includes multiple service sub-data sequences acquired in different time periods.

[0135] According to an embodiment of the present invention, a triangular fuzzy algorithm is used to process a service data set to be detected to obtain a fuzzy ideal solution that matches the service data set to be detected, including:

[0136] Determine the triangular fuzzy number of each business sub-data sequence. The triangular fuzzy number includes the maximum value, minimum value and target value in the business sub-data sequence. According to the sorting method of approximating the ideal solution, based on each triangular fuzzy number and the weight matching each business sub-data set, determine the positive fuzzy ideal solution and the negative fuzzy ideal solution.

[0137] According to an embodiment of the present invention, determining the triangular fuzzy number of each business sub-data sequence includes: when determining that the data in the business sub-data sequence is of non-numeric type, converting the data in the business sub-data sequence to obtain a business sub-data sequence of numerical type.

[0138] The maximum value, minimum value and target value are determined from the business sub-data sequence of numerical type to obtain triangular fuzzy numbers.

[0139] For example, the business sub-data sequence can be converted into triangular fuzzy numbers If the business sub-data sequence has a clear value, the minimum value is taken as the lower bound of the business sub-data sequence. , the maximum value is taken as the upper bound of the business sub-data sequence , the main value of the business sub-data sequence is taken as the main value of the triangular fuzzy number The main value may refer to the value with the highest frequency of occurrence in the business sub-data sequence, but is not limited thereto, and may also refer to the average value in the business sub-data sequence.

[0140] If there is no clear value, it is a non-numeric type of business sub-data sequence. For example, if the business sub-data sequence has n values, the n values ​​are evenly distributed between 0 and 1, and converted into triangular fuzzy numbers according to the above method to obtain triangular fuzzy numbers M (l, m, p).

[0141] For example, in a certain file data collection, one of the business sub-data sequences is the file operation time, and its value is 03:10. The same type of business sub-data sequence contains 10 different values, such as 08:00, 12:30, 5:36, etc. All the values ​​of the business sub-data sequence are arranged from small to large, and 03:10 is in the second position. Since this value cannot be directly counted as an integer, its minimum value is converted to an integer 0, and the maximum value is converted to a value 1. All values ​​are evenly distributed between 0 and 1, and the triangular fuzzy number converted to the file operation time business sub-data sequence in this data collection is M (0, 0.1, 1).

[0142] The data set to be tested may include, for example, a modification operation on a file that has been collected, which includes business sub-datasets such as file size, file operation type, file modification content, and operation permissions. According to the algorithm, select appropriate business sub-datasets to evaluate the performance of the target business system, including network traffic, system resource utilization, process behavior, file integrity, and other business sub-datasets. Assign weights to these business sub-datasets as W1, W2, W3, Wi, ..., Wn, etc., for a total of n business sub-datasets, and Wi represents the weight of the i-th business sub-dataset. Fuzzy weight vector The weight is required to be between 0 and 1. . The default value is W i =1 / n, the weight can be adjusted according to the actual situation. For example, in some equipment of the power system, the file is more important and more important for Trojan detection, so a higher weight is given. For example, the weight of the business sub-dataset can be assigned to 0.2 by default. In a certain actual application, for example, locating Trojan behavior by file operation time is a relatively effective method, and the corresponding weight for the business sub-dataset can be adjusted to 0.35.

[0143] According to an embodiment of the present invention, the positive fuzzy ideal solution and the negative fuzzy ideal solution of the service data set to be detected can be determined based on each triangular fuzzy number and the weight matching each service sub-data set according to the sorting method of approximating the ideal solution.

[0144] According to an embodiment of the present invention, it is possible to define Mij ​​represents the triangular fuzzy number of the jth business sub-data sequence in the i-th business sub-data set.

[0145] The decision plans can be ranked based on a ranking method that approximates the ideal solution, such as the TOPSIS (Topology of Best and Bad Solutions) principle. First, positive ideal solutions and negative ideal solutions are defined.

[0146] definition is the positive fuzzy ideal solution of the service data set to be detected, where the subset fuzzy ideal solution of the i-th service sub-data set includes the subset positive fuzzy ideal solution and the subset negative fuzzy ideal solution. The subset positive fuzzy ideal solution includes ,definition is the negative fuzzy ideal solution of the business data set to be detected, where the subset negative fuzzy ideal solution of the i-th business sub-data set includes .

[0147] According to an embodiment of the present invention, based on the business data set to be detected and the fuzzy ideal solution, determining the Trojan detection result of the target business system includes: determining the triangular fuzzy number of each business sub-data sequence. The triangular fuzzy number includes the maximum value, the minimum value and the target value in the business sub-data sequence. Based on the subset fuzzy ideal solution and the positive fuzzy ideal solution of each business sub-data set, determine the first distance between the business data set to be detected and the positive fuzzy ideal solution. Based on the subset fuzzy ideal solution and the negative fuzzy ideal solution of each business sub-data set, determine the second distance between the business data set to be detected and the negative fuzzy ideal solution. Based on the first distance and the second distance, determine the Trojan detection result of the target business system.

[0148] Calculate the Hausdorff measure and measure the distance between the service data set to be detected and the positive fuzzy ideal solution and the negative fuzzy ideal solution according to formulas 1 and 2:

[0149] (1);

[0150] (2).

[0151] Define the business data set to be tested The relative closeness between the fuzzy ideal solution is The larger the value, the better the solution. The threshold is set to H. When the relative closeness is greater than H, the collected data can be considered to be a Trojan horse, and the alarm returns the result. If it is less than H, it returns that it is not a Trojan horse. H can be set to 0.8 by default and can be adjusted according to the application scenario.

[0152] According to the embodiments of the present invention, the parameters affecting the business can be divided into two categories: one is the size of system resource usage. The more system resources the Trojan detection system occupies, the fewer system resources can be allocated to business applications, and the greater the impact on the business. The other is the Trojan false alarm rate. If a false alarm is generated, it will cause business delays or interruptions, which has a greater impact on the business.

[0153] The Trojan detection algorithm provided by the present invention has an accuracy rate of up to 88% during testing, and a false alarm rate of only 4%. This shows that it can provide good protection against Trojan detection and ensure normal business operations.

[0154] Figure 3 A flow chart of a Trojan detection method according to another embodiment of the present invention is shown.

[0155] like Figure 3 As shown, the Trojan detection method includes operations S310 to S370.

[0156] In operation S310, a service data set to be detected is input into a state detection model, and a model detection result is output.

[0157] In operation S320, it is determined whether the model detection result indicates that the target business system is abnormal. If yes, operation S330 is performed, otherwise the operation is stopped.

[0158] In operation S330, when it is determined that the model detection result indicates that the target business system is abnormal, the business data set to be detected is matched with the preset detection rule to obtain a rule detection result.

[0159] In operation S340, it is determined whether the rule detection result indicates that the target business system is implanted with a predetermined type of Trojan. If not, operation S350 is executed, otherwise an alarm is issued.

[0160] In operation S350, when it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, a triangular fuzzy algorithm is used to process the business data set to be detected to obtain a fuzzy ideal solution that matches the business data set to be detected.

[0161] In operation S360, a Trojan detection result of the target business system is determined based on the business data set to be detected and the fuzzy ideal solution.

[0162] In operation S370, based on the Trojan detection result, it is determined whether the target business system is implanted with a Trojan. If so, an alarm is issued. If not, the operation is stopped.

[0163] Based on the Trojan detection results, it can be determined whether the target business system has been implanted with a Trojan. If so, an alarm indicating that a Trojan has been implanted is issued. If not, it is considered that a Trojan has not been implanted and the operation is stopped.

[0164] Based on the above Trojan detection method, the present invention also provides a Trojan detection device. Figure 4 The device is described in detail.

[0165] Figure 4 A structural block diagram of a Trojan detection device according to an embodiment of the present invention is shown.

[0166] like Figure 4 As shown, the Trojan detection device 400 of this embodiment includes a model detection module 410 , a rule detection module 420 , an ideal solution determination module 430 and a Trojan detection module 440 .

[0167] The model detection module 410 is used to input the business data set to be detected into the state detection model and output the model detection result. The business data set to be detected represents the state data of the target business system in the process of processing the business. In one embodiment, the model detection module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0168] The rule detection module 420 is used to match the service data set to be detected with the preset detection rules to obtain the rule detection result when it is determined that the model detection result indicates that the target service system is abnormal. In one embodiment, the rule detection module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0169] The ideal solution determination module 430 is used to process the business data set to be detected using a triangular fuzzy algorithm to obtain a fuzzy ideal solution that matches the business data set to be detected when the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan. In one embodiment, the ideal solution determination module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0170] The Trojan detection module 440 is used to determine the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution. In one embodiment, the Trojan detection module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0171] According to an embodiment of the present invention, any multiple modules among the model detection module 410, the rule detection module 420, the ideal solution determination module 430 and the Trojan detection module 440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the model detection module 410, the rule detection module 420, the ideal solution determination module 430 and the Trojan detection module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the model detection module 410 , the rule detection module 420 , the ideal solution determination module 430 , and the Trojan detection module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0172] According to an embodiment of the present invention, the state detection model is obtained through the following modules of the Trojan detection device:

[0173] The clustering module is used to cluster the historical business data set to obtain multiple clusters.

[0174] The screening module is used to screen the historical business data set based on multiple clusters to obtain the target historical business data set.

[0175] The labeling module is used to label each historical business data in the target historical business data set with a predetermined label to obtain a training set.

[0176] The training module is used to train the support vector machine using the training set to obtain a state detection model.

[0177] According to an embodiment of the present invention, the Trojan detection device further includes: a comparison module and a model result determination module.

[0178] The comparison module is used to compare the model detection result with a predetermined reference threshold to obtain a comparison result.

[0179] The model result determination module is used to determine whether the model detection result represents an abnormality of the target business system based on the comparison result.

[0180] According to an embodiment of the present invention, the preset detection rules include Trojan startup rules, Trojan operation rules, and network signal rules.

[0181] According to an embodiment of the present invention, the rule detection module includes: a first matching submodule, a second matching submodule, a third matching submodule and a rule detection submodule.

[0182] The first matching submodule is used to match the service data set to be detected with the startup data features contained in the Trojan startup rule to obtain a startup matching result, and determine the startup rule detection result based on the startup matching result and the Trojan startup rule.

[0183] The second matching submodule is used to match the business data set to be detected with the operation data features contained in the Trojan operation rules to obtain the operation matching results, and determine the operation rule detection results based on the operation matching results and the Trojan operation rules.

[0184] The third matching submodule is used to match the service data set to be detected with the network data features contained in the network signal rule to obtain a network matching result, and determine the network rule detection result based on the network matching result and the network signal rule.

[0185] The rule detection submodule is used to obtain the rule detection result based on the startup rule detection result, the operation rule detection result and the network rule detection result.

[0186] According to an embodiment of the present invention, the rule detection submodule includes: a first detection unit and a second detection unit.

[0187] A first detection unit is used to determine that the rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan horse, if it is determined that any one of the startup rule detection result, the operation rule detection result, and the network rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan horse; and

[0188] The second detection unit is used to determine that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan when it is determined that the startup rule detection result, the operation rule detection result and the network rule detection result all indicate that the target business system is not implanted with a predetermined type of Trojan.

[0189] According to an embodiment of the present invention, the fuzzy ideal solution includes a positive fuzzy ideal solution and a negative fuzzy ideal solution.

[0190] The service data set to be detected includes multiple service sub-data sets of different types, and each service sub-data set includes multiple service sub-data sequences acquired in different time periods.

[0191] The Trojan detection module includes:

[0192] The fuzzy number determination submodule is used to determine the subset fuzzy ideal solution of each business sub-data set based on the triangular fuzzy number of each business sub-data sequence, wherein the triangular fuzzy number includes the maximum value, the minimum value and the target value in the business sub-data sequence.

[0193] The first distance determination submodule is used to determine the first distance between the service data set to be detected and the positive fuzzy ideal solution based on the subset fuzzy ideal solution and the positive fuzzy ideal solution of each service subdata set.

[0194] A second distance determination submodule, configured to determine a second distance between the service data set to be detected and the negative fuzzy ideal solution based on the subset fuzzy ideal solution and the negative fuzzy ideal solution of each service sub-data set; and

[0195] The Trojan determination submodule is used to determine the Trojan detection result of the target business system based on the first distance and the second distance.

[0196] According to an embodiment of the present invention, the ideal solution determination module includes: a fuzzy number determination submodule and a sorting submodule.

[0197] The fuzzy number determination submodule is used to determine the triangular fuzzy number of each business sub-data sequence, wherein the triangular fuzzy number includes the maximum value, the minimum value and the target value in the business sub-data sequence.

[0198] The sorting submodule is used to determine the positive fuzzy ideal solution and the negative fuzzy ideal solution based on each triangular fuzzy number and the weight matched with each business sub-data set according to the sorting method of approximating the ideal solution.

[0199] According to an embodiment of the present invention, the fuzzy number determination submodule includes: a conversion unit and a fuzzy number determination unit.

[0200] The conversion unit is used to convert the data in the business sub-data sequence to obtain a business sub-data sequence of a numerical type when it is determined that the data in the business sub-data sequence is of a non-numeric type.

[0201] The fuzzy number determination unit is used to determine the maximum value, the minimum value and the target value from the business sub-data sequence of the numerical type to obtain a triangular fuzzy number.

[0202] According to an embodiment of the present invention, the service data set to be detected is obtained through the following modules of the Trojan detection device:

[0203] The file acquisition module is used to acquire a file operation data set within a preset time period.

[0204] The communication acquisition module is used to acquire the network communication data set within a preset time period.

[0205] The program acquisition module is used to obtain the program running data set within a preset time period.

[0206] The data acquisition module is used to obtain the business data set to be detected based on the file operation data set, the network communication data set and the program operation data set.

[0207] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0208] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present invention may be combined and / or combined in various ways, even if such combinations and / or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments and / or claims of the present invention may be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All of these combinations and / or combinations fall within the scope of the present invention.

[0209] The embodiments of the present invention are described above. However, these embodiments are only for the purpose of illustration, and are not intended to limit the scope of the present invention. Although each embodiment is described above, it does not mean that the measures in each embodiment cannot be used in combination. The scope of the present invention is defined by the attached claims and their equivalents. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A Trojan detection method, characterized in that: The method comprises: Inputting a business data set to be detected into a state detection model and outputting a model detection result, wherein the business data set to be detected represents state data of the target business system in the process of processing business; When it is determined that the model detection result indicates that the target business system is abnormal, the business data set to be detected is matched with a preset detection rule to obtain a rule detection result; In the case where it is determined that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, the business data set to be detected is processed using a triangular fuzzy algorithm to obtain a fuzzy ideal solution that matches the business data set to be detected; and Determine a Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution; The preset detection rules include Trojan startup rules, Trojan operation rules, and network signal rules; The matching of the service data set to be detected with the preset detection rule to obtain the rule detection result includes: Matching the service data set to be detected with the startup data features contained in the Trojan startup rule to obtain a startup matching result, and determining a startup rule detection result based on the startup matching result and the Trojan startup rule; Matching the service data set to be detected with the operation data features contained in the Trojan operation rule to obtain an operation matching result, and determining an operation rule detection result based on the operation matching result and the Trojan operation rule; Matching the service data set to be detected with the network data features contained in the network signal rule to obtain a network matching result, and determining a network rule detection result based on the network matching result and the network signal rule; In the case where it is determined that any one of the startup rule detection result, the operation rule detection result, and the network rule detection result indicates that the target business system has been implanted with a predetermined type of Trojan, determining that the rule detection result indicates that the target business system has been implanted with the predetermined type of Trojan; and In the case where it is determined that the startup rule detection result, the operation rule detection result, and the network rule detection result all indicate that the target business system is not implanted with the predetermined type of Trojan, determining that the rule detection result indicates that the target business system is not implanted with the predetermined type of Trojan; Among them, the startup data characteristics, the operation data characteristics and the network data characteristics are all abnormal behavior characteristics used to characterize the existence of a Trojan horse.

2. The method according to claim 1, characterized in that The state detection model is obtained in the following way: Cluster the historical business data set to obtain multiple clusters; Based on the multiple clusters, the historical business data set is screened to obtain a target historical business data set; Labeling each historical business data in the target historical business data set with a predetermined label to obtain a training set; as well as The training set is used to train a support vector machine to obtain the state detection model.

3. The method according to claim 2, characterized in that The method further comprises: Comparing the model detection result with a predetermined reference threshold to obtain a comparison result; and Based on the comparison result, it is determined whether the model detection result indicates that the target business system is abnormal.

4. The method according to claim 1, characterized in that The fuzzy ideal solution includes a positive fuzzy ideal solution and a negative fuzzy ideal solution; The service data set to be detected includes a plurality of service sub-data sets of different types, and each of the service sub-data sets includes a plurality of service sub-data sequences acquired in different time periods; The determining the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution includes: Determine a subset fuzzy ideal solution of each of the business sub-data sets based on the triangular fuzzy number of each of the business sub-data sequences, wherein the triangular fuzzy number includes a maximum value, a minimum value and a target value in the business sub-data sequence; Based on the subset fuzzy ideal solution of each of the service subset data sets and the positive fuzzy ideal solution, determining a first distance between the service dataset to be detected and the positive fuzzy ideal solution; Determining a second distance between the service data set to be detected and the negative fuzzy ideal solution based on the subset fuzzy ideal solution of each service sub-data set and the negative fuzzy ideal solution; and Based on the first distance and the second distance, a Trojan detection result of the target business system is determined.

5. The method according to claim 4, characterized in that The method of processing the service data set to be detected by using a triangular fuzzy algorithm to obtain a fuzzy ideal solution matching the service data set to be detected includes: Determining a triangular fuzzy number for each of the business sub-data sequences, wherein the triangular fuzzy number includes a maximum value, a minimum value, and a target value in the business sub-data sequence; and According to the sorting method of approximating the ideal solution, the positive fuzzy ideal solution and the negative fuzzy ideal solution are determined based on each of the triangular fuzzy numbers and the weight matched with each of the business sub-data sets.

6. The method according to claim 4 or 5, characterized in that: Determining the triangular fuzzy number of each of the business sub-data sequences includes: When it is determined that the data in the service sub-data sequence is of a non-numeric type, converting the data in the service sub-data sequence to obtain a service sub-data sequence of a numeric type; and The maximum value, the minimum value and the target value are determined from the business sub-data sequence of the numerical type to obtain the triangular fuzzy number.

7. The method according to claim 1, characterized in that The service data set to be detected is obtained in the following manner: Obtaining a file operation data set within a preset period; Obtaining a network communication data set within a preset time period; Obtaining a program running data set within a preset period; as well as The service data set to be detected is obtained based on the file operation data set, the network communication data set and the program running data set.

8. A Trojan detection device, characterized in that: The device comprises: A model detection module is used to input a business data set to be detected into a state detection model and output a model detection result, wherein the business data set to be detected represents the state data of the target business system in the process of processing the business; A rule detection module, for matching the to-be-detected business data set with a preset detection rule to obtain a rule detection result when it is determined that the model detection result indicates that the target business system is abnormal; an ideal solution determination module, configured to, when determining that the rule detection result indicates that the target business system is not implanted with a predetermined type of Trojan, process the business data set to be detected using a triangular fuzzy algorithm to obtain a fuzzy ideal solution that matches the business data set to be detected; and A Trojan detection module, used to determine the Trojan detection result of the target business system based on the business data set to be detected and the fuzzy ideal solution; The preset detection rules include Trojan startup rules, Trojan operation rules, and network signal rules; The rule detection module includes: A first matching submodule, used to match the service data set to be detected with the startup data features contained in the Trojan startup rule to obtain a startup matching result, and determine a startup rule detection result based on the startup matching result and the Trojan startup rule; A second matching submodule is used to match the service data set to be detected with the operation data features contained in the Trojan operation rule to obtain an operation matching result, and determine the operation rule detection result based on the operation matching result and the Trojan operation rule; A third matching submodule, used for matching the service data set to be detected with the network data features contained in the network signal rule to obtain a network matching result, and determining a network rule detection result based on the network matching result and the network signal rule; A rule detection submodule, used to obtain the rule detection result based on the startup rule detection result, the operation rule detection result and the network rule detection result; Wherein, the rule detection submodule includes: A first detection unit is used to determine that the rule detection result indicates that the target business system has been implanted with the predetermined type of Trojan horse, if it is determined that any one of the startup rule detection result, the operation rule detection result, and the network rule detection result indicates that the target business system has been implanted with the predetermined type of Trojan horse; and A second detection unit is used to determine that the rule detection result indicates that the target business system is not implanted with the predetermined type of Trojan horse when it is determined that the startup rule detection result, the operation rule detection result, and the network rule detection result all indicate that the target business system is not implanted with the predetermined type of Trojan horse; Among them, the startup data characteristics, the operation data characteristics and the network data characteristics are all abnormal behavior characteristics used to characterize the existence of a Trojan horse.

Images