Remote control Trojan defense method and device based on flow in connection establishment stage

Abstract

The invention discloses a remote control Trojan defense method and device based on flow in a connection establishment stage, belongs to intrusion detection and information security, and particularly relates to detection and termination of remote control Trojan. The problem that the remote control Trojan horse cannot be timely and accurately detected and terminated before the remote control Trojan horse initiates an attack to a victim host due to the defects of poor timeliness of remote control Trojan horse detection, heavy detection and light blocking in the existing detection method based on network flow is solved. The method comprises the following steps: monitoring a network card on a host, and capturing network traffic flowing through the network card in real time; preprocessing the captured network traffic, and obtaining a Markov matrix representing the session traffic according to the session traffic in the connection establishment stage; and discriminating the generated Markov matrix by using a deep learning model or a machine learning model. The remote control Trojan defense method and device based on the flow in the connection establishment stage are suitable for detection and termination of remote control Trojan.

Description

Technical Field

[0001] The present invention relates to intrusion detection and information security, and in particular to the detection and termination of remote control Trojans. Background Art

[0002] A remote control Trojan (program) is a remote control program that can be spread in a variety of ways and implanted into a victim host to gain control of it and steal user confidential information. Remote control Trojan attacks can cause the leakage of important data, seriously threatening the security of cyberspace.

[0003] The remote control Trojan program has a client / server (C / S) architecture. Accordingly, the remote control Trojan component implanted on the victim host is called the "client", and the corresponding component used by the attacker to communicate with the client is called the "server". The attacker can send attack instructions through the server, and then the client performs the corresponding malicious operations on the victim host and returns the execution results to the server. The remote control Trojan is highly concealed. Once it infects the host, it can secretly perform various malicious operations on the victim host.

[0004] There is no doubt that remote control Trojan attacks pose a major threat to the data security of individuals and organizations. Developing corresponding remote control Trojan detection technology to detect and terminate the remote control Trojan in a timely and accurate manner before it attacks the victim host has important theoretical research significance and practical application value for the maintenance of cyberspace security.

[0005] At present, the traditional remote control Trojan detection methods (techniques) can be divided into three research directions according to the different detection objects (files, host behavior and network traffic): the first is the static detection method based on files, the second is the dynamic detection method based on hosts, and the third is the detection method based on network traffic, among which:

[0006] File-based static detection methods detect remote control Trojans by extracting static features from binary files, executable files, or decompiled files. The commonly used static detection method in the industry is the blacklist method that compares the hash value of the executable file. Although the file-based static detection method can complete the detection without running the remote control Trojan program, this method is difficult to deal with problems such as code obfuscation or packing, and the detection effect on unknown samples is poor.

[0007] The host-based dynamic detection method runs the remote control Trojan in a controlled virtual environment, monitors and records the host file system modifications, registry key value modifications, remote process injections, and specific application programming interface (API) function calls, and then analyzes these characteristics to determine whether the program is a remote control Trojan. Generally speaking, the host-based dynamic detection method focuses on the host behavior characteristics of the application at runtime, rather than relying on the static characteristics of the file, and can detect remote control Trojans that use code obfuscation or packing technology. However, this method requires the deployment of a detection system on each protected host, which is not only expensive to deploy, but also requires high system privileges and consumes more system resources.

[0008] Detection methods based on network traffic can be roughly divided into two types: detection methods based on statistical characteristics and detection methods based on traffic load.

[0009] The detection method based on statistical features mainly analyzes the communication behavior of remote control Trojans and detects them by extracting the statistical features of RAT during the communication process. Existing methods of this type require time-consuming feature engineering to achieve high detection accuracy, and their effectiveness depends on expert experience.

[0010] Traffic load-based detection methods mainly analyze the TCP load of TCP packets in the network traffic generated by the software during the communication process to determine whether the host is attacked by a remote control Trojan. Although existing methods of this type do not require expert knowledge and time-consuming feature engineering, these methods use part of the traffic of the remote control Trojan in the command and control stage, resulting in these methods being unable to accurately detect the remote control Trojan before the victim host is attacked.

[0011] Detection methods based on network traffic are currently a hot topic in the field of remote control Trojan detection. However, most of these detection methods currently focus on the accuracy of remote control Trojan detection, but the timeliness of remote control Trojan detection is poor, which makes it impossible for such methods to accurately detect remote control Trojans before they attack the victim host. When remote control Trojans are detected, the user's confidential information has been leaked. From the perspective of data security, such detection has no practical significance. In addition, current detection methods based on network traffic still have a tendency to "focus on detection and neglect blocking". They only focus on the detection of remote control Trojan traffic, but do not consider further remote control Trojan termination or the termination effect is poor. As a result, although many methods can detect remote control Trojan traffic with high accuracy, they fail to effectively terminate it in time, and their application value in actual scenarios is not high.

[0012] In summary, there is an urgent need for a remote control Trojan horse detection and termination method that can detect and terminate the remote control Trojan horse in a timely and accurate manner before the remote control Trojan horse launches an attack on the victim host. Summary of the invention

[0013] The present invention proposes a remote control Trojan defense method and device based on the flow in the connection establishment phase, which solves the shortcomings of the existing detection methods based on network flow, such as poor timeliness of remote control Trojan detection and emphasis on detection rather than blocking, and the problem that the remote control Trojan cannot be detected and terminated in a timely and accurate manner before it launches an attack on the victim host.

[0014] The technical solution of the remote control Trojan defense method based on the flow in the connection establishment phase described in the present invention is as follows:

[0015] The method comprises the following steps:

[0016] S1, monitors the network card on the host and captures the network traffic flowing through the network card in real time;

[0017] S2, preprocessing the captured network traffic to obtain session traffic, and obtaining a Markov matrix characterizing the session traffic according to the session traffic in the connection establishment phase; the step S2 includes the following steps:

[0018] S2.1, cutting the captured network traffic into different session traffic according to triples; the triples include source IP, destination IP, and transport layer protocol;

[0019] S2.2, extracting the byte sequence of the session traffic in the connection establishment phase;

[0020] S2.3, generating a corresponding Markov matrix according to the obtained byte sequence to characterize the session traffic;

[0021] S3, using a deep learning model or a machine learning model to judge the generated Markov matrix, and judge whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan:

[0022] If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately;

[0023] Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked;

[0024] S4, determine whether continuous monitoring is needed:

[0025] If continuous monitoring is required, return to step S1;

[0026] Otherwise, the remote control Trojan defense method process ends.

[0027] Furthermore, a preferred implementation is provided, wherein the session traffic in the connection establishment phase starts with a SYN packet in the session traffic and ends with the first TCP data packet sent by the client to its server and carrying a TCP payload of no less than 60 bytes.

[0028] Furthermore, a preferred implementation is provided, in step S3, a deep learning model is used to discriminate the generated Markov matrix;

[0029] The deep learning model is a CNN model;

[0030] The CNN model is used to output the category label of the Markov matrix;

[0031] The category label is used to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

[0032] Further, a preferred embodiment is provided, wherein the Markov matrix is ​​expressed as follows:

[0033]

[0034] Among them, P m,n represents the transition probability from byte m to the next byte n, n, n∈{0,1,…,255};

[0035]

[0036] Among them, f m,n Indicates the frequency of moving from byte m to byte n.

[0037] Further, a preferred embodiment is provided, wherein step S3 further comprises the following steps:

[0038] When it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan horse, an alarm email is sent to the user's mailbox.

[0039] The present invention also proposes a remote control Trojan defense device based on the flow in the connection establishment phase, and its technical solution is as follows:

[0040] The device comprises the following modules: a flow real-time capture module, a flow preprocessing module, a detection and analysis module and a termination module;

[0041] The real-time traffic capture module is used to monitor the network card on the host and capture the network traffic flowing through the network card in real time;

[0042] The traffic preprocessing module is used to preprocess the captured network traffic to obtain session traffic, and obtain a Markov matrix representing the session traffic according to the session traffic in the connection establishment phase; the traffic preprocessing module includes the following units: a traffic segmentation unit, a byte extraction unit, and a Trojan horse identification unit;

[0043] The traffic segmentation unit is used to segment the captured network traffic into different session traffic according to the triples;

[0044] The triplet includes source IP, destination IP, and transport layer protocol;

[0045] The byte extraction unit is used to extract the byte sequence of the session traffic in the connection establishment phase;

[0046] The Trojan horse identification unit is used to generate a corresponding Markov matrix according to the acquired byte sequence to characterize the session traffic;

[0047] The detection and analysis module is used to use a deep learning model or a machine learning model to discriminate the generated Markov matrix to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan:

[0048] If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately;

[0049] Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked;

[0050] The termination module is used to determine whether continuous monitoring is required:

[0051] If continuous monitoring is required, return to step S1;

[0052] Otherwise, the remote control Trojan defense method process ends.

[0053] Furthermore, a preferred embodiment is provided, wherein the detection and analysis module further includes an alarm unit:

[0054] The alarm unit is used to send an alarm email to a user mailbox when it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

[0055] The present invention also proposes a computer system, and its technical solution is as follows:

[0056] A computer system includes: a processor and a memory, wherein the memory is used to store executable instructions of the processor, and the processor is configured to execute the above-mentioned remote control Trojan defense method based on connection establishment phase traffic by executing the executable instructions.

[0057] The present invention also proposes a computer storage medium, and its technical solution is as follows:

[0058] The storage medium stores a computer program, and when the computer program is run, the above-mentioned remote control Trojan defense method based on the flow in the connection establishment phase is executed.

[0059] The present invention also proposes a computer program product, and its technical solution is as follows:

[0060] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned remote control Trojan defense method based on the flow in the connection establishment phase.

[0061] The present invention has the following beneficial effects:

[0062] 1. The remote control Trojan defense method based on the flow in the connection establishment phase described in the present invention identifies the remote control Trojan based on the flow in the connection establishment phase, detects in a timely and accurate manner, and can take effective termination measures to avoid losses to users caused by the host being infected by the remote control Trojan.

[0063] 2. The remote control Trojan defense method based on the traffic in the connection establishment phase described in the present invention captures the network traffic flowing through the host network card in real time, and performs remote control Trojan detection by analyzing the network traffic of the software in the connection establishment phase, taking into account the timeliness, accuracy and real-time termination capability of remote control Trojan detection, and can detect and terminate the remote control Trojan in real time before it launches an attack on the victim host.

[0064] The remote control Trojan defense method and device based on the flow in the connection establishment phase described in the present invention are suitable for the detection and termination of the remote control Trojan. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0066] Figure 1 A schematic diagram of a flow chart of a remote control Trojan defense method based on flow in the connection establishment phase in one embodiment of the present invention;

[0067] Figure 2 This is a structural diagram of a deep learning model (specifically a CNN model) in one embodiment of the present invention; wherein, the conv layer represents the convolution layer, the full name of conv in English is Convolution, the conv1 layer represents the first convolution layer, and the conv2 layer represents the second convolution layer; the Pooling layer represents the pooling layer; the Flatten layer represents the flattening layer; the BN layer represents the batch normalization layer; the Fc layer represents the fully connected layer, and the full name of Fc in English is Fully Connected; the Dropout layer is understood to represent the "random inactivation layer"; the Softmax layer is an activation function layer used to process the output of the classification problem. DETAILED DESCRIPTION

[0068] In order to make the technical solutions and advantages of the present invention more clearly described, the specific implementation methods of the present invention will be further described in detail and completely in conjunction with the accompanying drawings. The various implementation methods described below are only part of the preferred solutions of the present invention, rather than all implementation methods; the various implementation methods described below are intended to explain the present invention and cannot be understood as limitations on the present invention; the reasonable combination of technical features defined in the various implementation methods of the present invention, and all other implementation methods obtained by ordinary technicians in the field without creative work based on the implementation methods of the present invention, are within the scope of protection of the present invention.

[0069] Implementation Method 1: Combination Figure 1 and 2 This embodiment describes a remote control Trojan defense method based on the flow in the connection establishment phase. The specific implementation contents are as follows:

[0070] The method comprises the following steps:

[0071] S1, monitors the network card on the host and captures the network traffic flowing through the network card in real time;

[0072] S2, preprocessing the captured network traffic to obtain session traffic, and obtaining a Markov matrix characterizing the session traffic according to the session traffic in the connection establishment phase; the step S2 includes the following steps:

[0073] S2.1, cutting the captured network traffic into different session traffic according to triples; the triples include source IP, destination IP, and transport layer protocol;

[0074] S2.2, extracting the byte sequence of the session traffic in the connection establishment phase;

[0075] S2.3, generating a corresponding Markov matrix according to the obtained byte sequence to characterize the session traffic;

[0076] S3, using a deep learning model or a machine learning model to judge the generated Markov matrix, and judge whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan:

[0077] If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately;

[0078] Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked;

[0079] S4, determine whether continuous monitoring is needed:

[0080] If continuous monitoring is required, return to step S1;

[0081] Otherwise, the remote control Trojan defense method process ends.

[0082] In this implementation manner, the representation format of the triplet is {source IP, destination IP, transport layer protocol}.

[0083] In this implementation, if the process corresponding to the session traffic represented by the Markov matrix is ​​determined not to be a remote control Trojan horse, it is considered to be benign software, and its process will not be blocked, and the benign software can run normally in the system.

[0084] In this embodiment, if the process corresponding to the session traffic represented by the Markov matrix is ​​determined to be a remote control Trojan, the corresponding remote control Trojan process is immediately terminated to prevent further malicious behavior of the remote control Trojan, effectively avoiding losses to users due to host infection with the remote control Trojan.

[0085] Implementation Method 2: Combination Figure 1 and 2 This embodiment is described. This embodiment is a further limitation of the remote control Trojan defense method based on the flow in the connection establishment phase described in the first embodiment. The specific implementation contents are as follows:

[0086] The session traffic in the connection establishment phase starts with a SYN packet in the session traffic and ends with the first TCP data packet sent by the client to its server and carrying a TCP payload of no less than 60 bytes.

[0087] In this implementation manner, the first TCP data packet sent by the client to its server and carrying a TCP payload of no less than 60 bytes is the first online packet of the remote control Trojan or benign software.

[0088] In this implementation manner, the connection establishment phase of the remote control Trojan or benign software is located based on the above-mentioned initial "SYN packet" and the terminated "TCP data packet".

[0089] Implementation Method 3: Combination Figure 1 and 2 This embodiment is described. This embodiment is a further limitation of the remote control Trojan defense method based on the flow in the connection establishment phase described in the first embodiment. The specific implementation contents are as follows:

[0090] In step S3, a deep learning model is used to discriminate the generated Markov matrix;

[0091] The deep learning model is a CNN model;

[0092] The CNN model is used to output the category label of the Markov matrix;

[0093] The category label is used to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

[0094] In this implementation, the size of the Markov matrix input to the CNN model is a fixed size, specifically 256×256.

[0095] In this implementation, the CNN model outputs the category label of the Markov matrix through the Softmax function.

[0096] In this embodiment, the CNN model includes 2 convolutional layers, 2 pooling layers, 1 flatten layer, 1 BN layer, 1 fully connected layer, 1 Dropout layer and 1 Softmax layer;

[0097] In the CNN model, from input to output, the first convolution layer, the first pooling layer, the second convolution layer, the second pooling layer, a flatten layer, a BN layer, a fully connected layer, a Dropout layer and a Softmax layer are connected in sequence.

[0098] In this implementation, the deep learning model is constructed and trained using Python language combined with keras and tensorflow.

[0099] Implementation Method 4: Combination Figure 1 and 2 This embodiment is described. This embodiment is a further limitation of the remote control Trojan defense method based on the flow in the connection establishment phase described in the first embodiment. The specific implementation contents are as follows:

[0100] The Markov matrix is ​​represented as follows:

[0101]

[0102] Among them, P m,n represents the transition probability from byte m to the next byte n, m,n∈{0,1,…,255};

[0103]

[0104] Among them, f m,n Indicates the frequency of moving from byte m to byte n.

[0105] In this implementation, the calculation process of the Markov matrix M is as follows:

[0106] Suppose the byte sequence of a session extracted is Bytes = {Byte i :i>0};

[0107] Assume Byte i The probability of occurrence is only related to Byte i-1 is related, so the byte sequence is a Markov chain;

[0108] The possible value of each byte in the byte sequence is 0 to 255, that is, each byte has 256 states, and each state can be transferred to any state, and further a Markov matrix M with a fixed size of 256×256 can be generated; specifically:

[0109] Let P m,n represents the transition probability from byte m to the next byte n, then P m,n It is expressed as follows:

[0110]

[0111] Among them, f m,n represents the frequency of moving from byte m to byte n, m,n∈{0,1,…,255};

[0112] After using the above formula to calculate the transition probability from each byte to each other byte, the Markov matrix M is obtained:

[0113]

[0114] Implementation Method 5: Combination Figure 1 and 2 This embodiment is described. This embodiment is a further limitation of the remote control Trojan defense method based on the flow in the connection establishment phase described in the first embodiment. The specific implementation contents are as follows:

[0115] The step S3 also includes the following steps:

[0116] When it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan horse, an alarm email is sent to the user's mailbox.

[0117] Implementation Method 6: Combination Figure 1 and 2 This embodiment is described. This embodiment provides a remote control Trojan defense device based on the flow in the connection establishment phase. The specific implementation contents are as follows:

[0118] The device comprises the following modules: a flow real-time capture module, a flow preprocessing module, a detection and analysis module and a termination module;

[0119] The real-time traffic capture module is used to monitor the network card on the host and capture the network traffic flowing through the network card in real time;

[0120] The traffic preprocessing module is used to preprocess the captured network traffic to obtain session traffic, and obtain a Markov matrix representing the session traffic according to the session traffic in the connection establishment phase; the traffic preprocessing module includes the following units: a traffic segmentation unit, a byte extraction unit, and a Trojan horse identification unit;

[0121] The traffic segmentation unit is used to segment the captured network traffic into different session traffic according to the triples;

[0122] The triplet includes source IP, destination IP, and transport layer protocol;

[0123] The byte extraction unit is used to extract the byte sequence of the session traffic in the connection establishment phase;

[0124] The Trojan horse identification unit is used to generate a corresponding Markov matrix according to the acquired byte sequence to characterize the session traffic;

[0125] The detection and analysis module is used to use a deep learning model or a machine learning model to discriminate the generated Markov matrix to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan:

[0126] If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately;

[0127] Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked;

[0128] The termination module is used to determine whether continuous monitoring is required:

[0129] If continuous monitoring is required, return to step S1;

[0130] Otherwise, the remote control Trojan defense method process ends.

[0131] In this implementation, the device is used to implement the method described in the first implementation.

[0132] Implementation Method 7: Combination Figure 1 and 2 This embodiment is described. This embodiment is a further limitation of the remote control Trojan defense device based on the flow in the connection establishment phase described in Embodiment 6. The specific implementation contents are as follows:

[0133] The detection and analysis module also includes an alarm unit:

[0134] The alarm unit is used to send an alarm email to a user mailbox when it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

[0135] Implementation 8: To illustrate the effect of the method described in the above implementation, this implementation provides a comparative experimental test.

[0136] The comparative experiment was tested on a data set of network traffic containing 67 remote control Trojans and 67 benign software, and the detection effect of the method described in the above implementation mode was compared with other remote control Trojan traffic detection methods.

[0137] In the comparative experimental test, the method described in the above implementation mode (referred to as this method) is tested from a realistic perspective to focus on its ability to detect "unknown remote-controlled Trojans" (i.e., remote-controlled Trojans that are not used to train the detection model). The experimental results show that this method can detect unknown remote-controlled Trojans with an accuracy rate of up to 98.6% on the above data set, which is better than other detection methods.

[0138] In the comparative experimental test, the experimental sample set is divided into remote control Trojan samples and benign software samples, see Table 1 and Table 2 respectively.

[0139] Table 1 Remote control Trojan samples

[0140]

[0141] Table 2 Benign software samples

[0142]

[0143] In the comparative experimental test, the experimental environment is deployed as follows:

[0144] The remote control Trojans (active from 2013 to 2018) clients and benign software with serial numbers 1 to 52 in Tables 1 and 2 were deployed in one or more virtual operating environments of {Windows 7 Professional (32-bit), Windows 7 Enterprise (64-bit), Windows 8 (64-bit), Windows 10 Professional (64-bit), Windows Server 2019 (64-bit)}; the generated session traffic was divided into training set and validation set according to a ratio of 4:1;

[0145] The remote control Trojan clients (active from 2018 to 2024) and benign software with serial numbers 53 to 67 in Tables 1 and 2 are deployed in the {Windows 10 Education (64-bit), Windwos 11 Professional (64-bit)} virtual operating environment to generate session traffic for the test set.

[0146] In the comparative experimental test, the distribution and composition of the data set are shown in Table 3, where the training set, validation set and test set have no intersection with each other.

[0147] Table 3 Distribution and composition of the dataset

[0148]

[0149] In the comparative experimental test, the detection effects of this method and other detection methods are shown in Table 4.

[0150] Table 4 Detection results of different methods

[0151]

[0152] The experimental results show that the method described in this embodiment (ie, this method) achieved a detection accuracy of 98.6%, which is better than other detection methods.

[0153] The method described in this embodiment can implement remote control Trojan detection during the connection establishment phase of the remote control Trojan and has high detection accuracy, that is, it can accurately detect the remote control Trojan before it launches an attack on the victim host. This is of great practical significance for timely detection of remote control Trojans and effective termination, as well as protection of users' confidential information.

[0154] In the comparative experimental test, the literature sources of other detection methods compared with this method are as follows:

[0155] Jiang W, Wu X, Cui

[0156] Jiang D,Omote K.An approach to detect remote access trojan in the early stage of communication[C] / / 2015IEEE 29th international conference on advanced information networking and applications.IEEE,2015:706-713.

[0157] Guo Chun, Pi Ben, Shen Guowei, et al. A remote control Trojan traffic early detection model construction method, device and detection method based on convolutional neural network: 202211455368.8[P].20221121.

[0158] The technical solution provided by the present invention is further described in detail above through several specific implementation modes in order to highlight the advantages and benefits of the technical solution provided by the present invention. However, the several specific implementation modes described above are not intended to be used as limitations on the present invention. Any reasonable changes and improvements to the present invention, reasonable combinations of implementation modes and equivalent substitutions based on the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A remote control Trojan defense method based on the flow of the connection establishment phase, characterized in that: The method comprises the following steps: S1, monitors the network card on the host and captures the network traffic flowing through the network card in real time; S2, preprocessing the captured network traffic to obtain session traffic, and obtaining a Markov matrix characterizing the session traffic according to the session traffic in the connection establishment phase; the step S2 includes the following steps: S2.1, cutting the captured network traffic into different session traffic according to triples; the triples include source IP, destination IP, and transport layer protocol; S2.2, extracting the byte sequence of the session traffic in the connection establishment phase; S2.3, generating a corresponding Markov matrix according to the obtained byte sequence to characterize the session traffic; S3, using a deep learning model or a machine learning model to judge the generated Markov matrix, and judge whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan: If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately; Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked; S4, determine whether continuous monitoring is needed: If continuous monitoring is required, return to step S1; Otherwise, the remote control Trojan defense method process ends.

2. The remote control Trojan defense method based on the flow in the connection establishment phase according to claim 1 is characterized in that: The session traffic in the connection establishment phase starts with a SYN packet in the session traffic and ends with the first TCP data packet sent by the client to its server and carrying a TCP payload of no less than 60 bytes.

3. The remote control Trojan defense method based on the flow in the connection establishment phase according to claim 1 is characterized in that: In step S3, a deep learning model is used to discriminate the generated Markov matrix; The deep learning model is a CNN model; The CNN model is used to output the category label of the Markov matrix; The category label is used to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

4. The remote control Trojan defense method based on the flow in the connection establishment phase according to claim 1 is characterized in that: The Markov matrix is ​​represented as follows: Among them, P m,n represents the transition probability from byte m to the next byte n, m,n∈{0,1,…,255}; Among them, f m,n Indicates the frequency of moving from byte m to byte n.

5. The remote control Trojan defense method based on the flow in the connection establishment phase according to claim 1 is characterized in that: The step S3 also includes the following steps: When it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan horse, an alarm email is sent to the user's mailbox.

6. A remote control Trojan defense device based on the flow of the connection establishment phase, characterized in that: The device comprises the following modules: a flow real-time capture module, a flow preprocessing module, a detection and analysis module and a termination module; The real-time traffic capture module is used to monitor the network card on the host and capture the network traffic flowing through the network card in real time; The traffic preprocessing module is used to preprocess the captured network traffic to obtain session traffic, and obtain a Markov matrix representing the session traffic according to the session traffic in the connection establishment phase; The traffic preprocessing module includes the following units: a traffic segmentation unit, a byte extraction unit, and a Trojan horse identification unit; The traffic segmentation unit is used to segment the captured network traffic into different session traffic according to triples; the triples include source IP, destination IP, and transport layer protocol; The byte extraction unit is used to extract the byte sequence of the session traffic in the connection establishment phase; The Trojan horse identification unit is used to generate a corresponding Markov matrix according to the acquired byte sequence to characterize the session traffic; The detection and analysis module is used to use a deep learning model or a machine learning model to discriminate the generated Markov matrix to determine whether the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan: If it is determined to be a remote control Trojan, the remote control Trojan process corresponding to the session traffic represented by the Markov matrix is ​​located according to the relevant information of the session traffic, and it is terminated immediately; Otherwise, the process corresponding to the session traffic represented by the Markov matrix is ​​not blocked; The termination module is used to determine whether continuous monitoring is required: If continuous monitoring is required, return to step S1; Otherwise, the remote control Trojan defense method process ends.

7. The remote control Trojan defense device based on the flow in the connection establishment phase according to claim 6 is characterized in that: The detection and analysis module also includes an alarm unit: The alarm unit is used to send an alarm email to a user mailbox when it is determined that the process corresponding to the session traffic represented by the Markov matrix is ​​a remote control Trojan.

8. A computer system comprising: A processor and a memory, characterized in that the memory is used to store executable instructions of the processor, and the processor is configured to execute the remote control Trojan defense method based on connection establishment phase traffic as described in any one of claims 1 to 5 by executing the executable instructions.

9. A computer storage medium, characterized in that The storage medium stores a computer program, and when the computer program is run, the remote control Trojan defense method based on the flow in the connection establishment phase as described in any one of claims 1 to 5 is executed.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the remote control Trojan defense method based on the flow in the connection establishment phase as described in any one of claims 1 to 5 are implemented.

Images