Trojan horse virus detection method and device

Abstract

The invention discloses a Trojan virus detection method and device in the Internet field, and the method comprises the steps: configuring a Trojan virus environment, and collecting flow data in the Trojan virus environment; carrying out bidirectional flow division on the collected flow data according to a quintuple, and carrying out feature extraction to obtain flow feature data; obtaining training set data obtained by processing the traffic feature data, and training a machine learning model by using the training set data to obtain a Trojan virus recognition model; wherein the processing comprises the following steps of: performing normalization processing on the traffic characteristic data; and utilizing the Trojan virus identification model to identify the hiding mode and Trojan activity stage of the Trojan virus. According to the method, the flow of the Trojan horse is detected, the hiding mode of the Trojan horse is locked and the activity stage of the Trojan horse is identified under the condition of high hiding.

Description

Technical Field

[0001] The present invention belongs to the field of Internet technology, and specifically relates to a Trojan virus detection method and device Background Art

[0002] Trojan software is a type of malware, which refers to malicious code that disguises itself as a legitimate program or file. Trojan software hides under a seemingly harmless appearance, and when the user runs or opens it, the malicious code will be executed, resulting in system intrusion, data theft, control takeover, etc.

[0003] After infecting the target host, the Trojan software will actively connect to the command and control server (Command & Control, C2) according to the attack process pre-set by the attacker. If the communication is direct, a simple traffic audit can capture the IP address or domain name information of the suspicious C2 host, thereby completing the tracing of the attacker and causing the attack to fail. Therefore, the attacker will use some technologies to hide the real IP of the C2 server, such as serverless cloud function (SCF) or DNS hidden tunnel, etc. By using different hiding methods, the attacker can direct the traffic of the same Trojan to different proxy services, which not only hides the relevant information of its own C2 server, but also confuses itself with the normal traffic using the corresponding service, increasing the difficulty of tracking the Trojan traffic.

[0004] Faced with the diverse hiding methods of Trojan viruses, if a single identification tool is used in combination, the detection time of the attack will be prolonged and malicious behavior cannot be stopped in time.

[0005] Therefore, a technology is needed that can detect the traffic of Trojans in a highly concealed situation and lock down the concealment method of Trojans. Summary of the invention

[0006] In order to solve the above technical problems, the embodiments of the present invention provide a Trojan virus detection method and device to solve the problems raised by the prior art.

[0007] In order to achieve the above purpose, the embodiment of the present invention adopts the following technical solution:

[0008] An embodiment of the present invention provides a Trojan virus detection method, the method comprising:

[0009] Configure a Trojan virus environment and collect traffic data in the Trojan virus environment;

[0010] The collected traffic data is divided into two-way traffic according to five-tuples, and features are extracted to obtain traffic feature data;

[0011] Acquire training set data obtained after processing the traffic feature data, so as to train a machine learning model using the training set data to obtain a Trojan virus recognition model; wherein the processing includes: normalizing the traffic feature data;

[0012] The Trojan virus identification model is used to identify the hiding method of the Trojan virus and the Trojan activity stage.

[0013] Wherein, the configuration includes:

[0014] Configure the traffic for information exchange with the control and command server in a concealed manner of at least two Trojan viruses;

[0015] Configure the traffic during the Trojan's silent period and the traffic during the Trojan's active period.

[0016] Wherein, the configuration includes:

[0017] Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, it still resends data and continues to maintain a connection with the command and control server.

[0018] The processing also includes: regularizing the flow characteristic data and labeling the flow characteristic data.

[0019] The step of using the training set data to train the machine learning model includes:

[0020] Adjust the maximum depth value in the model parameters to a unique value of 13.

[0021] Among them, the feature extraction includes extracting the following features: the average size of the reverse data packet of the data flow, the total time and average time before the data flow sends two data packets in the forward and reverse directions, the average length of the flow, the total number of bytes in the headers of the forward and reverse data packets of the data flow, the number of data packets with the PUSH field, and the number of bytes sent in the reverse initial window of the data flow and the average time that the flow is active before becoming idle.

[0022] Another embodiment of the present invention further provides a Trojan virus detection device comprising:

[0023] The first unit is used to configure a Trojan virus environment and collect traffic data in the Trojan virus environment;

[0024] The second unit is used to divide the collected traffic data into two-way traffic according to five-tuples, and perform feature extraction to obtain traffic feature data;

[0025] The third unit is used to obtain training set data obtained after processing the traffic feature data, so as to train a machine learning model using the training set data to obtain a Trojan virus recognition model; wherein the processing includes: normalizing the traffic feature data;

[0026] The fourth unit is used to identify the hiding mode of the Trojan virus and the Trojan activity stage by using the Trojan virus identification model.

[0027] The first unit configures the Trojan virus environment including:

[0028] Configure the traffic for information exchange with the control and command server in a concealed manner of at least two Trojan viruses;

[0029] Configure the traffic during the Trojan's silent period and the traffic during the Trojan's active period.

[0030] The first unit configures the Trojan virus environment including:

[0031] Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, it still resends data and continues to maintain a connection with the command and control server.

[0032] The processing of the flow characteristic data by the third unit further includes: regularizing the flow characteristic data and labeling the flow characteristic data.

[0033] The third unit uses the training set data to train the machine learning model, which includes:

[0034] Adjust the maximum depth value in the model parameters to a unique value of 13.

[0035] Among them, the features extracted by the second unit include:

[0036] The average size of the reverse packets of the data flow, the total and average time before two packets are sent in the forward and reverse directions of the data flow, the average length of the flow, the total number of bytes in the forward and reverse packet headers of the data flow, the number of packets with the PUSH field, and the number of bytes sent in the reverse initial window of the data flow and the average time the flow is active before becoming idle.

[0037] The embodiments of the present invention have the following beneficial effects:

[0038] The present invention solves the problem of identifying multiple highly concealed Trojan methods. It can help the defender to specify a more targeted response strategy and take different countermeasures for different hiding methods. It can also help the security team respond to threats more quickly and limit the impact of attacks. Finally, the identification of different hiding methods also helps the security team collect intelligence about attackers, attack targets, etc., so as to better understand the threat environment.

[0039] In addition, the present invention solves the problem of identifying different Trojan activity stages in a variety of high-concealment modes. By identifying the different activity stages of Trojans, the defender can perform specialized defensive actions for different Trojan activity stages. For example, the actual threat of an active Trojan can be immediately blocked, and at the same time, the behavior, strategy, and purpose used by the attacker during the attack stage can be understood, which helps to improve defense measures and prevent similar attacks in advance. Moreover, because the actual attack behavior is captured, evidence can be obtained to provide assistance for subsequent legal actions; and the identification of silent Trojans can help the security team better understand the attack path, the attacker's goals, and the evolution of attack technology, while identifying and repairing the vulnerabilities and weaknesses in the system, thereby strengthening the defense mechanism.

[0040] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 This is a schematic diagram of the cloud function hiding principle of an embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the VPS forwarding anonymity principle of an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of the DNS tunnel hiding principle of an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the DoH tunnel hiding principle of an embodiment of the present invention;

[0046] Figure 5 A schematic diagram of different activity stages of a Trojan virus according to an embodiment of the present invention;

[0047] Figure 6 A flow chart of a Trojan virus detection method according to an embodiment of the present invention;

[0048] Figure 7 It is a schematic diagram of the structure of a Trojan virus detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable when appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In the embodiments of the present invention, the term "multiple" refers to two or more, and other quantifiers are similar.

[0051] It should be mentioned before discussing the exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the operations as sequential processes, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0052] The methods discussed below (some of which are illustrated by flow charts) may be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented by software, firmware, middleware, or microcode, program code or code segments to perform the necessary tasks may be stored in a machine or computer readable medium (such as a storage medium). (One or more) processors may perform the necessary tasks.

[0053] The terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments. Unless the context clearly indicates otherwise, the singular forms "one", "one" and "item" used herein are also intended to include plural numbers. It should also be understood that the terms "include" and / or "comprise" used herein specify the existence of stated features, integers, steps, operations, units and / or components, without excluding the existence or addition of one or more other features, integers, steps, operations, units, components and / or combinations thereof.

[0054] It should also be noted that, in some alternative implementations, the functions / actions mentioned may occur in a different order than that indicated in the accompanying drawings. For example, depending on the functions / actions involved, two figures shown in succession may actually be performed substantially simultaneously or may sometimes be performed in the reverse order.

[0055] In order to better identify Trojan viruses, the inventors analyzed the hiding methods and activity stages of Trojan viruses. The hiding principle of the target virus is: between the victim host and the C2 server, a group of network resource services with benign network functions are added for its malicious traffic to forward. On the victim host side, only the network communication between the infected host and the proxy server can be seen, and no information related to the real C2 server can be detected.

[0056] The commonly used concealment methods are as follows:

[0057] Cloud function hiding: The schematic diagram of its principle is as follows Figure 1 As shown in the figure, Serverless Cloud Function (SCF) is mainly a serverless execution environment provided for enterprises and developers, which can run code without purchasing and managing servers. Developers only need to write core code in a language supported by the platform and set the conditions for code running, so that they can run the code flexibly and securely on the cloud infrastructure. Because cloud functions are deployed in multiple locations, different IP addresses will be switched for each request, so the C2 server IP can be effectively hidden. Although the default access domain name will still be obtained by the defender, in general, the defender cannot directly obtain personal information from the cloud function service provider based on the API. Therefore, the characteristics of cloud functions can be used to hide the CS server.

[0058] VPS forwarding anonymity: The schematic diagram of its principle is as follows Figure 2As shown in the figure, the IP address of the C2 server can be successfully hidden by using a VPS (Virtual Private Server) proxy server. The VPS plays the role of transferring server and client data. The VPS is responsible for receiving client requests, proxying the requests, forwarding the requests to the C2 server, and then feeding back the corresponding results to the client. Because a proxy layer is added between the C2 server and the victim's client, when the victim sends a request, the requested IP is the IP of the VPS instead of the IP of the C2 server. Traffic analysis on the victim's end cannot directly obtain the real IP address of the C2 server. In this way, the IP address of the C2 server is successfully hidden.

[0059] DNS tunnel: Its principle diagram is as follows Figure 3 As shown in the figure, normal communication between networks occurs after the two machines establish a TCP connection. If the target is an IP, the message will be sent directly. If it is a domain name, the domain name will be resolved to an IP before communication. When the client backdoor program performs a DNS query, if the queried domain name is not in the cache of the DNS server, it will access the Internet for query and then return the result. If there is a server set up by the attacker on the Internet, the server can rely on the response of the domain name resolution to exchange data packets. From the perspective of the DNS protocol, such an operation is just to repeatedly query one or some specific domain names and obtain the resolution results, but its essence is that the expected return result of DNS should be an IP address, but in fact, the return can be any string, including encrypted C&C instructions, so that other protocols are encapsulated in the DNS protocol for transmission.

[0060] DoH tunnel: Its principle diagram is as follows Figure 4 As shown, DNS over HTTPS (DoH) itself is defined by RFC8484, one of its goals is to increase user privacy and resolve DNS queries through HTTPS. One of its major advantages is that it improves the security of DNS services and protects user privacy. Traditional malicious DNS covert tunnels can also use the DoH service to encrypt and encapsulate the HTTPS protocol to conceal their own CC domain names and further enhance their concealment. Therefore, the essence of DoH tunnel concealment is the DNS tunnel encapsulated by the HTTPS protocol. Its communication principle is the same as that of the DNS tunnel. At the same time, using port 443 for communication also improves the concealment of its own traffic to a certain extent, so it can be considered that the DoH tunnel is a DNS tunnel with better concealment.

[0061] During the research, the inventor found that in order to reduce the maliciousness of malicious behavior, attackers often set the activity stage of the Trojan horse, hide their attack behavior or conduct local vulnerability detection during the silent period, and only maintain connection with the C2 server with relatively less frequent and smaller heartbeat packets to avoid scanning by security detection programs; then enter the active period in certain time periods, such as holidays or weekdays, to infringe on the victim's host. Because the division of the silent period and the active period and the specific behavior of each stage will vary greatly due to the habits of the attacker, the classification and identification of each stage is beneficial to the defender to learn about organized and planned attack behaviors and strategies, so as to better prevent the corresponding attacks and trace them.

[0062] The present invention divides the activity phase of the Trojan into two phases: active phase and silent phase. Figure 5 As shown in the figure, the active period of the Trojan is the time period when the attacker communicates with the C2 server to complete malicious activities such as command transmission and data collection. The C2 server will exchange a large amount of data with the victim. The silent period of the Trojan is the time period when the attacker keeps the Trojan relatively inactive and does not perform obvious malicious activities. The victim only exchanges limited packets with the C2 server, such as heartbeat packets.

[0063] The attack phase of a Trojan is related to the attacker's attack strategy, but when there are both active and silent Trojans on the victim's host, it is critical to take appropriate measures and prioritize them. Active Trojans are performing malicious activities and may pose a real threat to system, data, and network security. Although silent Trojans may not have obvious malicious activities at present, they should not be ignored. They may become active at any time and pose a potential threat. If the attack phases of Trojans are not distinguished, and no priorities are arranged and corresponding treatment is performed, the active Trojans may not be handled in time, resulting in actual attacks on the victim's host or the spread of Trojans, which may have a wider impact. Therefore, determining whether a Trojan is in an active or silent phase is of great significance for the reasonable allocation of resources, the formulation of corresponding strategies, the rapid response to attacks, and the prevention of future threats. This distinction can help network security teams manage threats more effectively and reduce potential losses.

[0064] Based on the above analysis, the present invention is used to solve the problem of how to detect Trojan traffic, lock the Trojan's hiding method, and identify the Trojan's activity stage under high concealment conditions. By dividing the real-time traffic data into five-tuples, extracting the communication characteristics of the traffic, and investing in machine learning model training, suspicious Trojan traffic is found, the detection ability of Trojan traffic hiding methods and activity stages is improved, the ability of network security defense is improved, and the system and data are protected from threats.

[0065] The technical solution of the present application is further described in detail below in conjunction with the accompanying drawings.

[0066] like Figure 6 The figure shows a flow chart of a Trojan virus detection method provided by an embodiment of the present invention. The method can be applied to a personal computer host to protect personal data information, and can also be deployed to the device at the entrance and exit of the intranet network routing to control the entire internal network environment. It can also be deployed in a virtual environment such as a cloud to perform real-time evaluation and protection on the enterprise commercial environment. The method includes the following steps:

[0067] S10, configuring a Trojan virus environment, and collecting traffic data in the Trojan virus environment;

[0068] This step is mainly used to obtain the training set and test set required for the training model. Therefore, it is necessary to configure the Trojan virus environment to simulate the Trojan virus hiding method and activity stage. Therefore, the configuration of the Trojan virus environment mainly includes:

[0069] Configure the traffic for exchanging information with the control and command server in at least two hidden modes of Trojan viruses; and configure the traffic during the Trojan silent period and the traffic during the Trojan active period.

[0070] Specifically, a Trojan using various concealment methods can be constructed on the target machine side, at the command and control server, and at the intermediate proxy server. Among them, since the DNS and DoH protocols themselves are used to transmit domain name related information, the load of a single data packet is often limited, the bandwidth provided by the resolution server for each connection is limited, and the command content sent by the Trojan is highly repetitive, and it is easy for the resolution server to terminate the connection and send an error. In order to solve this problem, the present invention modifies the connection code in the Trojan control code so that after the connection is interrupted by the resolver, the data is still resent and the connection with the command control server is maintained. That is, the connection code in the Trojan control code is modified, and when the connection is interrupted by the resolution server, the Trojan packet is not terminated, but the data is resent to continue to maintain a connection with the command control server.

[0071] In addition, the original Trojan has a vulnerability in the server-side code design. It does not check the payload length of the sent data packets, which will cause data transmission failure if the server-side IP data layer sends data that is not a multiple of 8. We have added an additional payload length check function to the code for sending data, and filled the part that is less than a multiple of 8 with the character '0' to ensure the stability of the Trojan.

[0072] After completing the configuration of the Trojan virus environment, collect traffic data. Specifically, use wireshark software on the target machine for the operating system and windows, and use tcpdump tools on the linux machine to capture various real-time traffic of the target machine and generate a pcap file of the target machine network traffic.

[0073] S11, dividing the collected traffic data into two-way traffic according to five-tuples, and extracting features to obtain traffic feature data;

[0074] By dividing the traffic into five-tuples, each data flow in the network can be uniquely identified. Trojan traffic often communicates with the control command server in the form of session data flow. Using five-tuples to divide traffic can match the form of Trojan traffic well, making it easier for the model to learn the characteristics of Trojan traffic.

[0075] In addition, the division by quintuples can include rich spatiotemporal information of traffic, which is convenient for providing sufficient data for feature extraction.

[0076] The features extracted in this application include: the average size of the reverse data packet of the data flow, the total time and average time before the data flow sends two data packets in the forward and reverse directions, the average length of the flow, the total number of bytes in the forward and reverse data packet headers of the data flow, the number of packets with the PUSH field, the number of bytes sent in the reverse initial window of the data flow, and the average time that the flow is active before it becomes idle.

[0077] The present invention selects to extract the above features and has the following advantages:

[0078] The average size of the reverse data packet of the data flow: There is a difference between Trojan traffic and normal network service traffic. Normal traffic is the client actively initiating various requests to the server, while the victim end of Trojan traffic usually sends the same data to maintain the connection. Instead, the control command server end will actively initiate various requests to the victim end. Therefore, the average size of the reverse data packet of Trojan traffic is different from that of normal traffic and should be extracted as a feature.

[0079] The total time and average time before two packets are sent in the forward and reverse directions of the data flow: Normal traffic is between the client and the server, and is generally operated by the client. The total time and average time of requesting services are generally irregular and only related to people. However, due to the heartbeat behavior used to maintain the connection and some specific attack behaviors, the total time and average time of data transmission for Trojan traffic is often related to its specific behavior and has a certain regularity, so it is extracted as a feature.

[0080] Average length of flow: related to the total time and average time before two packets are sent forward and reversely in the data flow. Due to the artificiality and specificity of customer requests, the average length of normal flow is often meaningless. However, Trojan traffic executes planned attack behaviors with high similarity, and the average length of its flow can characterize the Trojan attack behavior to a certain extent, so it is extracted as a feature.

[0081] Total number of bytes in the forward and reverse packet headers of the data flow: Normal traffic often has limited use of packet headers, which are generally fixed lengths. However, because Trojan traffic needs to complete data transmission tasks as quickly as possible and carry additional information, it often performs additional operations or fills in the extended fields in the packet header, resulting in differences from normal traffic, so it is extracted as a feature.

[0082] Number of packets with PUSH fields: Normal traffic generally does not use PUSH fields, but Trojan traffic needs to complete the attack as quickly as possible and improve data transmission efficiency, so PUSH fields are usually enabled in packets. It can be used as a judgment point, so it is extracted as a feature.

[0083] The number of bytes sent in the reverse initial window of the data flow and the average time the flow is active before it becomes idle: In normal traffic, because the work and idleness of the server depend on the client's request, the number of bytes sent by the server and the average time are often determined by the client and the specific network environment at the time, which is specific. The active behavior of Trojan traffic mainly depends on the attack rules set by the Trojan in advance, so the number of bytes sent in the reverse initial window of the data flow and the average time of the active state have certain regularity, so they are extracted as features.

[0084] S12, obtaining training set data obtained after processing the traffic feature data, and using the training set data to train a machine learning model to obtain a Trojan virus recognition model;

[0085] The processing of the traffic characteristic data includes: regularizing the traffic characteristic data, labeling the traffic characteristic data, and normalizing the traffic characteristic data; specifically, the processing may include:

[0086] For the comma-separated values ​​(CSV) file of the feature extracted traffic features, we first perform code regularization processing, because in the machine learning model, we set the maximum depth to a specific value of 13, the purpose is to enhance the model's ability to identify the specific values ​​in the feature values ​​of the extracted features, but because this value exceeds the normal value of 10, the model is very likely to overfit, resulting in a decrease in the model's recognition ability or even a significant reduction. Therefore, using regularization processing can reduce the interference of individual error values ​​in the features on the subsequent specific learning of the model, increase the performance and stability of the model, and reduce the risk of overfitting.

[0087] In addition, if in an actual environment, some of the previously extracted features have abnormal or invalid feature values ​​due to the specific network environment or human settings, regularization of the extracted data can also help the model select more effective features for category judgment.

[0088] Because we need to identify the Trojan's concealment method and Trojan's activity stage, the initial data needs to be marked in the code. The marking content includes: the corresponding concealment method and activity stage of each data. Although the collected data is in the configured Trojan virus environment, it is inevitable to interact with the outside world. Therefore, in the process of data marking, it is also necessary to filter out other traffic that is not related to the Trojan traffic based on the previous feature extraction results to avoid its impact on data characteristics.

[0089] In addition, because the traffic collection process will be affected by network fluctuations and the specific network environment, a certain number of outliers will appear. Therefore, unlike ordinary machine learning data processing, the present invention normalizes the traffic to avoid the adverse effects of outliers on the model.

[0090] Because the model needs to complete too many classification categories, in order to enable the model to learn more specific features of each category to obtain better classification results, the present invention adjusts the maximum depth in the model parameters from the usual value of 3 to 10 to a specific value of 13 to adapt to this new problem.

[0091] In normal machine learning models, the maximum depth is often 3-10, in order to avoid the model learning features with special values, causing the model to blindly use these special values ​​or wrong values ​​as the standard for category judgment, thus causing overfitting. However, since the present invention needs to complete more classification categories and the differences between different concealment methods themselves are large, the model needs to learn more detailed feature values ​​for judgment. In addition, since the data is regularized during data processing, it can avoid model overfitting to a certain extent. Therefore, the present invention uses a value of 13 that is greater than the normal value. At the same time, in multiple experiments, the effect of using the parameter 13 is the best, so we finally set the value to 13.

[0092] The acquired traffic feature data is divided into training set and test set, and the training set is input into the machine learning model for parameter training, so as to obtain a convergent Trojan virus recognition model with good classification performance. The trained model is then tested on the test set.

[0093] S13, using the Trojan virus identification model to identify the hiding method of the Trojan virus and the Trojan activity stage.

[0094] The technical effects of the present invention are described below through specific experimental data.

[0095] The environment description is as follows: The traffic data is collected on the Windows 10 system. The normal traffic is collected through normal network activities on the host, such as web browsing, watching live broadcast software, using chat software, etc. Malicious traffic is generated by using Cobalt Strike software to generate Trojans. It is used as a carrier for Trojan generation and uses cloud function forwarding, VPS proxy forwarding, DNS tunnel, and DoH tunnel as a hidden way to communicate with the C2 server to generate traffic. The traffic that does not execute any instructions or only executes the sleep instruction (the instruction to modify the heartbeat cycle of the Trojan) is the Trojan silent period traffic, and the traffic that executes no less than two instructions (in addition to the sleep instruction, there is at least one instruction) is the Trojan active period traffic. The machine learning model used is XGBoost. The overall accuracy of the experiment is 0.93, and the detailed experimental results are as follows:

[0096] The Trojan concealment method and activity stage identification confusion matrix of the experiment are shown in Table 1:

[0097] Table 1

[0098]

[0099]

[0100] Note: benign represents normal traffic, scf represents Trojan silent period traffic hidden by cloud function, vps represents Trojan silent period traffic hidden by VPS forwarding, dns represents Trojan silent period traffic hidden by DNS tunnel, doh represents Trojan silent period traffic hidden by DoH tunnel, scf_cc represents Trojan active period traffic hidden by cloud function, vps_cc represents Trojan active period traffic hidden by VPS forwarding, dns_cc represents Trojan active period traffic hidden by DNS tunnel, and doh_cc represents Trojan active period traffic hidden by DoH tunnel.

[0101] The specific indicators of the experiment are shown in Table 2 below:

[0102] Table 2

[0103] Category\Indicator Precision Recall F1-score Support benign 1.00 1.00 1.00 6140 scf 0.77 0.76 0.77 933 vps 0.89 0.76 0.82 933 DNS 0.90 0.98 0.94 933 doh 0.96 0.87 0.91 273 scf_cc 0.77 0.84 0.80 933 vps_cc 0.81 0.83 0.82 933 dns_cc 1.00 0.97 0.98 933 doh_cc 0.91 0.94 0.92 273 macro avg 0.89 0.88 0.89 12284 weighted avg 0.93 0.93 0.93 12284

[0104] True Positive (TP): predict the positive class as the positive class number

[0105] False Positive (FP): predicting negative classes as positive classes

[0106] False Negative (FN): Predict the positive class as the negative class number

[0107] Accuracy:

[0108] Recall:

[0109]

[0110] Macro avg: the arithmetic average of all categories

[0111] Weighted average weighted avg: takes into account the proportion of each category sample in the total sample (weight is the proportion)

[0112] Experimental results analysis:

[0113] From the above indicators and confusion matrix, we can find that in the multi-classification task of distinguishing the hidden methods and Trojan activity stages, the Trojan virus recognition model can perfectly judge the maliciousness of the traffic, and there is no false positive or false negative for the normal traffic and malicious traffic categories, and it performs well.

[0114] In summary, the Trojan virus identification model trained by the present invention can effectively identify the maliciousness of traffic, and can also identify malicious traffic with different concealment methods and different Trojan active periods. To a certain extent, it can complete the task of identifying the malicious traffic concealment method and Trojan active period set in the experiment.

[0115] The present invention solves the problem of identifying multiple highly concealed Trojan methods. It can help the defender to specify a more targeted response strategy and take different countermeasures for different hiding methods. It can also help the security team respond to threats more quickly and limit the impact of attacks. Finally, the identification of different hiding methods also helps the security team collect intelligence about attackers, attack targets, etc., so as to better understand the threat environment.

[0116] In addition, the present invention solves the problem of identifying different Trojan activity stages in a variety of high-concealment modes. By identifying the different activity stages of Trojans, the defender can perform specialized defensive actions for different Trojan activity stages. For example, the actual threat of an active Trojan can be immediately blocked, and at the same time, the behavior, strategy, and purpose used by the attacker during the attack stage can be understood, which helps to improve defense measures and prevent similar attacks in advance. Moreover, because the actual attack behavior is captured, evidence can be obtained to provide assistance for subsequent legal actions; and the identification of silent Trojans can help the security team better understand the attack path, the attacker's goals, and the evolution of attack technology, while identifying and repairing the vulnerabilities and weaknesses in the system, thereby strengthening the defense mechanism.

[0117] The highly concealed Trojan virus method and the method for identifying the active stage proposed by the present invention are universal. The traffic division and feature extraction method used by the present invention do not rely on specific protocols or fields, and can detect all the traffic generated on the target machine. Moreover, since feature extraction does not involve interpretation of the traffic data packet payload, whether the traffic is encrypted does not affect the identification of the Trojan.

[0118] The embodiment of the present invention also provides a Trojan virus identification device, the structure diagram of the device is as follows: Figure 7 As shown, the device mainly includes:

[0119] The first unit 70 is used to configure a Trojan virus environment and collect traffic data in the Trojan virus environment;

[0120] The second unit 71 is used to divide the collected traffic data into two-way traffic according to five-tuples, and extract features to obtain traffic feature data;

[0121] The third unit 72 is used to obtain training set data obtained after processing the traffic feature data, so as to train a machine learning model using the training set data to obtain a Trojan virus recognition model; wherein the processing includes: normalizing the traffic feature data;

[0122] The fourth unit 73 is used to identify the hiding mode of the Trojan virus and the Trojan activity stage by using the Trojan virus identification model.

[0123] The first unit 70 configures the Trojan virus environment including:

[0124] Configure the traffic for information exchange with the control and command server in a concealed manner of at least two Trojan viruses;

[0125] Configure the traffic during the Trojan's silent period and the traffic during the Trojan's active period.

[0126] The first unit 70 configures the Trojan virus environment including:

[0127] Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, it still resends data and continues to maintain a connection with the command and control server.

[0128] The processing of the flow characteristic data by the third unit 72 further includes: regularizing the flow characteristic data and labeling the flow characteristic data.

[0129] The third unit 72 uses the training set data to train the machine learning model, including:

[0130] Adjust the maximum depth value in the model parameters to a unique value of 13.

[0131] The features extracted by the second unit 71 include:

[0132] The average size of the reverse packets of the data flow, the total and average time before two packets are sent in the forward and reverse directions of the data flow, the average length of the flow, the total number of bytes in the forward and reverse packet headers of the data flow, the number of packets with the PUSH field, and the number of bytes sent in the reverse initial window of the data flow and the average time the flow is active before becoming idle.

[0133] Regarding the device in the above embodiment, the specific manner in which each unit performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0134] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. It is not intended to limit the scope of the invention claimed for protection, but only represents the preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solution formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the inventive concept. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0135] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0136] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

[0137] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A Trojan virus detection method, characterized in that: The method comprises: Configure a Trojan virus environment and collect traffic data in the Trojan virus environment; The collected traffic data is divided into two-way traffic according to five-tuples, and features are extracted to obtain traffic feature data; Acquire training set data obtained after processing the traffic feature data, so as to train a machine learning model using the training set data to obtain a Trojan virus recognition model; wherein the processing includes: normalizing the traffic feature data; The Trojan virus identification model is used to identify the hiding method of the Trojan virus and the Trojan activity stage.

2. The method according to claim 1, characterized in that The configuration includes: Configure the traffic for information exchange with the control and command server in a concealed manner of at least two Trojan viruses; Configure the traffic during the Trojan's silent period and the traffic during the Trojan's active period.

3. The method according to claim 1 or 2, characterized in that: The configuration includes: Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, it still resends data and continues to maintain a connection with the command and control server.

4. The method according to claim 1, characterized in that: The processing also includes: regularizing the flow characteristic data and labeling the flow characteristic data.

5. The method according to claim 1, characterized in that The step of training the machine learning model using the training set data comprises: Adjust the maximum depth value in the model parameters to a unique value of 13.

6. The method according to claim 1, characterized in that The feature extraction includes extracting the following features: the average size of the reverse data packet of the data flow, the total time and average time before the data flow sends two data packets in the forward and reverse directions, the average length of the flow, the total number of bytes in the headers of the forward and reverse data packets of the data flow, the number of data packets with the PUSH field, and the number of bytes sent in the reverse initial window of the data flow and the average time that the flow is in an active state before it becomes idle.

7. A Trojan virus detection device, characterized in that: include: The first unit is used to configure a Trojan virus environment and collect traffic data in the Trojan virus environment; The second unit is used to divide the collected traffic data into two-way traffic according to five-tuples, and perform feature extraction to obtain traffic feature data; The third unit is used to obtain training set data obtained after processing the traffic feature data, so as to train a machine learning model using the training set data to obtain a Trojan virus recognition model; wherein the processing includes: normalizing the traffic feature data; The fourth unit is used to identify the hiding mode of the Trojan virus and the Trojan activity stage by using the Trojan virus identification model.

8. The device according to claim 1, characterized in that The first unit configures the Trojan virus environment including: Configure the traffic for information exchange with the control and command server in a concealed manner of at least two Trojan viruses; Configure the traffic during the Trojan's silent period and the traffic during the Trojan's active period.

9. The device according to claim 7 or 8, characterized in that The first unit configures the Trojan virus environment including: Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, it still resends data and continues to maintain a connection with the command and control server.

10. The device according to claim 1, characterized in that The features extracted by the second unit include: The average size of the reverse packets of the data flow, the total and average time before two packets are sent in the forward and reverse directions of the data flow, the average length of the flow, the total number of bytes in the forward and reverse packet headers of the data flow, the number of packets with the PUSH field, and the number of bytes sent in the reverse initial window of the data flow and the average time the flow is active before becoming idle.

Images