Trojan virus detection method and device

Abstract

The application discloses an Internet Trojan virus detection method and device, the method comprises the following steps: configuring a Trojan virus environment, and collecting traffic data under the Trojan virus environment; dividing the collected traffic data according to five tuples in a bidirectional manner, and extracting features to obtain traffic feature data; obtaining training set data obtained by processing the traffic feature data, training a machine learning model by using the training set data, and obtaining a Trojan virus identification model; wherein the processing comprises: normalizing the traffic feature data; and identifying the hiding mode of the Trojan virus and the activity stage of the Trojan virus by using the Trojan virus identification model. The application realizes the detection of Trojan virus traffic, the locking of the hiding mode of the Trojan virus, and the identification of the activity stage of the Trojan virus under high concealment.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of Internet, and particularly relates to a Trojan virus detection method and device BACKGROUND

[0002] Trojan software is a kind of malicious software, which is a malicious code disguised as a legitimate program or file. Trojan software hides under the appearance of seemingly harmless, when the user runs or opens it, it will execute malicious code, resulting in system intrusion, data theft, control takeover, etc.

[0003] After the Trojan software infects the target host, it will actively connect the command and control server (C2) according to the attack process set by the attacker in advance. If it directly communicates, simple traffic auditing can capture the IP address or domain name information of the suspicious C2 host, thereby completing the tracing of the attacker and causing the attack to fail. Therefore, the attacker will use some techniques to hide the real IP of the C2 server, such as Serverless Cloud Function (SCF) or DNS stealth tunnel, etc. By using different hiding methods, the attacker can direct the traffic of the same Trojan to different proxy services, hiding the information of the C2 server of the attacker, and at the same time confusing himself with normal traffic using the corresponding service, increasing the difficulty of tracking Trojan traffic.

[0004] In the face of the diversified concealment methods of Trojan viruses, if a single identification tool is used, the detection time of the attack will be prolonged, and the malicious behavior cannot be prevented in time.

[0005] Therefore, a technology is needed to detect Trojan traffic under high concealment and lock the concealment method of the Trojan. SUMMARY

[0006] To solve the above technical problems, the present application provides a Trojan virus detection method and device to solve the problems in the prior art.

[0007] In order to achieve the above purpose, the embodiments of the present application adopt the following technical solutions:

[0008] The present application provides a Trojan virus detection method, which comprises:

[0009] Configure a Trojan virus environment and collect traffic data under the Trojan virus environment;

[0010] According to the five-tuple, the collected traffic data is divided into bidirectional traffic, and feature extraction is performed to obtain traffic feature data;

[0011] Obtain training set data obtained after processing the traffic feature data, train a machine learning model using the training set data, and obtain a Trojan virus identification model; wherein the processing includes normalizing the traffic feature data;

[0012] Use the Trojan virus identification model to identify the concealment mode of the Trojan virus and the Trojan activity stage.

[0013] The configuration includes:

[0014] Configure the traffic of the at least two Trojan virus concealment modes and the information exchange with the command and control server.

[0015] Configure the Trojan silent period traffic and the Trojan active period traffic.

[0016] The configuration includes:

[0017] Modify the connection code in the Trojan control code so that after the connection is interrupted by the parser, the data is still re-sent to continue to maintain the connection with the command and control server.

[0018] The processing further includes regular processing of the traffic feature data and label processing of the traffic feature data.

[0019] The step of training a machine learning model using the training set data includes:

[0020] Adjust the maximum depth value in the model parameters to a specific value of 13.

[0021] The feature extraction includes extracting the following features: average size of reverse data packets of the data stream, total time and average time before sending two data packets of the data stream in the forward and reverse directions, average length of the flow, total number of bytes in the header of the data stream in the forward and reverse directions, number of data packets with the PUSH field, and number of bytes sent in the initial window of the reverse data stream and average time in the active state before the flow becomes idle.

[0022] Another embodiment of the application also provides a Trojan virus detection device comprising:

[0023] A first unit is configured to configure a Trojan virus environment and collect traffic data in the Trojan virus environment;

[0024] A second unit is configured to divide the collected traffic data into bidirectional traffic according to the five-tuple and extract features to obtain traffic feature data.

[0025] The third unit is configured to obtain training set data obtained by processing the traffic feature data, train a machine learning model by using the training set data, and obtain a Trojan virus identification model; wherein the processing comprises: performing normalization processing on the traffic feature data.

[0026] The fourth unit is configured to identify the hiding manner of the Trojan virus and the Trojan activity stage by using the Trojan virus identification model.

[0027] The first unit is configured to configure a Trojan virus environment, and the configuration comprises:

[0028] The configuration comprises: configuring traffic of at least two hiding manners of the Trojan virus and information exchange with the command and control server.

[0029] The configuration comprises: configuring Trojan silent period traffic and Trojan active period traffic.

[0030] The first unit is configured to configure a Trojan virus environment, and the configuration comprises:

[0031] The configuration comprises: modifying connection code in the Trojan control code, so that after the connection is interrupted by the parser, the data is still resent, and the connection with the command and control server is maintained.

[0032] The third unit is configured to perform regular processing on the traffic feature data and label processing on the traffic feature data.

[0033] The third unit is configured to train a machine learning model by using the training set data, and the training comprises:

[0034] The maximum depth value in the model parameter is adjusted to a specific value 13.

[0035] The second unit is configured to extract features, and the features comprise:

[0036] The features comprise: average size of reverse data packets of the data flow, total time and average time before sending two data packets of the data flow in the forward direction and the reverse direction, average length of the flow, total number of bytes of the data packet header in the forward direction and the reverse direction of the data flow, number of data packets with the PUSH field, and number of bytes sent in the initial window of the reverse direction of the data flow and average time of the flow in the active state before becoming an idle state.

[0037] The embodiment of the application has the following beneficial effects:

[0038] The present application solves the problem of identifying multiple high-concealment modes of Trojans. It can help the defender to specify a more targeted response strategy, take different countermeasures for different hidden modes, and also help the security team to respond to threats more quickly and limit the impact of attacks. Finally, the identification of different hidden modes can also help the security team to collect information about the attacker, the target of the attack, etc., so as to better understand the threat environment.

[0039] In addition, the present application solves the problem of identifying different Trojan activity stages under multiple high-concealment modes. Through the identification of different Trojan activity stages, the defender can take specific defense actions for different Trojan activity stages. For example, for active Trojans, immediate action can be taken to prevent actual threats, while understanding the behavior, strategy and purpose of the attacker during the attack phase can help improve defense measures, prevent similar attacks in advance, and because the actual attack behavior is captured, evidence can be obtained to help subsequent legal action. The identification of silent Trojans can help the security team better understand the attack path, the target of the attacker and the evolution of attack technology, while identifying and repairing vulnerabilities and weaknesses in the system to strengthen the defense mechanism.

[0040] Of course, implementing any product or method of the present application does not necessarily require all the advantages described above. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0042] Figure 1 The cloud function concealment principle diagram of the present application embodiment;

[0043] Figure 2 The VPS forwarding concealment principle diagram of the present application embodiment;

[0044] Figure 3 The DNS tunnel concealment principle diagram of the present application embodiment;

[0045] Figure 4 The DoH tunnel concealment principle diagram of the present application embodiment;

[0046] Figure 5 The Trojan virus different activity stage diagram of the present application embodiment;

[0047] Figure 6 The Trojan virus detection method flowchart of the present application embodiment;

[0048] Figure 7 Figure 1 is a schematic diagram of a Trojan detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0050] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally a class, and are not limited to the number of objects, for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist together, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects. The term "a plurality of" in the embodiments of the present application means two or more, and other quantifiers are similar.

[0051] Before the example embodiments are discussed in more detail, it should be mentioned that some of the example embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the operations as sequential processes, many of the operations can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The processes can be terminated when their operations are completed, but can also have additional steps not included in the figures. The processes can correspond to methods, functions, routines, subroutines, etc.

[0052] The methods discussed later (some of which are shown by flow charts) can be implemented by hardware, software, firmware, middleware, microcode, hardware description language or any combination thereof. When implemented by software, firmware, middleware or microcode, the program code or code segments used to implement the necessary tasks can be stored in a machine or computer readable medium (such as a storage medium). The processor(s) can implement the necessary tasks.

[0053] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0054] It should also be noted that in some alternative implementations, the functions / acts described can occur out of the order noted in the figures. For example, two figures shown in succession can in fact be executed substantially concurrently or can sometimes be executed in the reverse order, depending upon the functionality / acts involved.

[0055] In order to better identify the Trojan virus, the inventors analyze the hiding manner and activity stage of the Trojan virus. The hiding principle of the target virus is that a batch of network resource services with benign network functions are added between the victim host and the C2 server for forwarding malicious traffic. On the side of the victim host, only network communication between the infected host and the proxy server can be seen, and information about the real C2 server cannot be known.

[0056] The current commonly used hiding manner is as follows:

[0057] Cloud function hiding: The principle diagram is as shown in Figure 1 The cloud function (SCF) is mainly a serverless execution environment provided for enterprises and developers, which can run code without purchasing and managing servers. The developer only needs to write core code using the language supported by the platform and set the conditions for running the code, and then the code can be run elastically and securely on the cloud infrastructure. Because the cloud function adopts a multi-site deployment mode, different IP addresses are switched for each request, so the C2 server IP can be effectively hidden. Although the default access domain name is still obtained by the defending party, the defending party generally cannot obtain personal information directly from the cloud function service provider according to the API. Therefore, the CS server can be hidden by the characteristics of the cloud function.

[0058] VPS forwarding hiding: The principle diagram is as shown in Figure 2As shown, the IP address of the C2 server can be successfully hidden using a VPS (Virtual Private Server) proxy server. The VPS acts as a relay server for client data, and can be responsible for receiving client requests, proxying the requests, forwarding the requests to the C2 server, and then feeding back the corresponding results to the client. Because an additional layer of proxy is added between the C2 server and the victim client, when the victim sends a request, the requested IP is the IP of the VPS rather than the IP of the C2 server. Traffic analysis on the victim end cannot directly obtain the real IP address of the C2 server. In this way, the IP address of the C2 server is successfully hidden.

[0059] DNS tunnel: its principle diagram is as shown in Figure 3 The communication between normal networks occurs after two machines establish a TCP connection. If the target is an IP, the message is sent directly, and if it is a domain name, the domain name is resolved to an IP for communication. When the client backdoor program performs DNS query, if the queried domain name is not in the local cache of the DNS server, the Internet is accessed for query, and then the result is returned. If there is an attacker's server on the Internet, the server can exchange data packets based on the response of the domain name resolution. From the perspective of DNS protocol, such operation is only repeatedly querying a certain or certain specific domain name and obtaining the resolution result, but the essence is that the expected return result of DNS should be an IP address, and in fact, any string can be returned, including encrypted C&C instructions, so that other protocols are encapsulated in the DNS protocol for transmission.

[0060] DoH tunnel: its principle diagram is as shown in Figure 4 DNS over HTTPS (DoH) itself is defined by RFC8484, one of its goals is to increase user privacy by resolving DNS queries through HTTPS. One of its big advantages is to improve the security of DNS services and protect user privacy. Traditional malicious DNS stealth tunnel can also use DoH service to encrypt and encapsulate HTTPS protocol to achieve the function of hiding its CC domain name and further enhance its stealth. Therefore, the essence of DoH tunnel stealth is a DNS tunnel encapsulated through HTTPS protocol, and its communication principle is the same as that of DNS tunnel. At the same time, using 443 port for communication also improves the stealth of its own traffic to some extent, so it can be considered that DoH tunnel is a better stealth DNS tunnel.

[0061] The inventors found in the research process that, in order to reduce the maliciousness of malicious behaviors, attackers often set up the activity stage of the Trojan horse, hide their attack behaviors in the silent period or perform local vulnerability detection, only maintain connection with the C2 server with a relatively small frequency and a small packet size heartbeat packet, and evade the scanning of the security detection program; and then enter the active period at some specific time period, such as holidays or weekdays, to harm the victim host. Because the division of the silent period and the active period and the specific behaviors of each stage will greatly differ due to the habits of the attackers, classification and identification of each stage are beneficial to the defense party to learn the organized and planned attack behaviors and strategies, so as to better prevent the corresponding attacks and trace the attacks.

[0062] The present application divides the activity stage of the Trojan horse into an active period and a silent period, as shown in Figure 5 The active period of the Trojan horse, that is, the time period in which the attacker completes malicious activities such as instruction transmission and data collection through communication with the C2 server, the C2 server end will exchange a large amount of data with the victim end; and the silent period of the Trojan horse, that is, the time period in which the attacker keeps a relatively inactive state and does not perform obvious malicious activities, that is, the victim end only exchanges limited packets with the C2 server end, such as heartbeat packet exchange.

[0063] The attack stage of the Trojan horse is related to the attack strategy of the attacker, but for the case where the active period and the silent period Trojan horses exist on the victim host at the same time, it is very critical to take appropriate processing and priority arrangement. The active period Trojan horse is executing malicious activities, which may cause actual threats to system, data and network security. Although the silent period Trojan horse may not have obvious malicious activities at present, it cannot be ignored. They may enter the active state at any time, causing potential threats. If the attack stage of the Trojan horse is not distinguished, no priority arrangement and corresponding processing is performed, the active period Trojan horse may not be processed in time, the victim host may be actually attacked, or the Trojan horse may be spread, which may cause a larger range of influence. Therefore, determining whether a Trojan horse is in the active period or the silent period is of great significance for reasonably configuring resources, formulating corresponding strategies, quickly responding to attacks and preventing future threats. This distinction can help the network security team to more effectively manage threats and reduce potential losses.

[0064] Based on the above analysis, the present application is used to solve how to detect the Trojan horse traffic under high concealment, lock the concealment mode of the Trojan horse, and identify the activity stage of the Trojan horse. By dividing the five-tuple of real-time traffic data, extracting the communication characteristics of the traffic, inputting the machine learning model for training, finding out the suspicious Trojan horse traffic, improving the detection capability of the Trojan horse traffic hiding mode and the activity stage, and improving the capability of network security defense, the system and data are protected from threats.

[0065] The technical solutions of the present application will be described in further detail below with reference to the accompanying drawings.

[0066] As Figure 6 Fig. 1 is a flow chart of a Trojan virus detection method according to an embodiment of the present application. The method can be applied to a personal computer host end for protecting personal data information, can be deployed to a device at an entrance and exit of an internal network routing for controlling the entire internal network environment, and can also be deployed to a cloud or other virtual environment for real-time evaluation and protection of an enterprise commercial environment. The method comprises the following steps:

[0067] S10, configuring a Trojan virus environment and collecting traffic data in the Trojan virus environment;

[0068] This step is mainly used to obtain a training set and a test set required by a training model, and therefore a Trojan virus environment needs to be configured to simulate a Trojan virus concealment manner and an activity stage. Therefore, the configuration of the Trojan virus environment mainly comprises:

[0069] configuring traffic of information exchange between at least two Trojan viruses and a command and control server in a concealment manner; and configuring Trojan silent period traffic and Trojan active period traffic.

[0070] Specifically, Trojans using various concealment manners can be constructed at a target machine side, a command and control server, and an intermediate proxy server. Since the DNS and DoH protocols are used to transmit domain name related information, the payload of a single data packet is limited, the bandwidth provided by a parsing server for each connection is limited, and the command content sent by the Trojan is highly repetitive and is easy to be terminated by the parsing server and send an error. In order to solve this problem, the connection code in the Trojan control code is modified so that after the connection is interrupted by the parser, the data is still re-sent to continue to maintain the connection with the command and control server. That is, the connection code in the Trojan control code is modified, and after the connection is interrupted by the parsing server, the Trojan does not terminate the packet sending, but re-sends the data to continue to maintain the connection with the command and control server.

[0071] In addition, the original Trojan has a bug in the server end code design, which does not perform packet payload length inspection on the sent data packet, which will cause the server end IP data layer to send data that is not a multiple of 8, resulting in data sending failure. We additionally added a payload length inspection function at the code of the data sending, and filled the part that is not a multiple of 8 with '0' characters to ensure the stability of the Trojan.

[0072] After the completion of the Trojan virus environment configuration, traffic data is collected, which can be specifically: at the target machine, the target machine various real-time traffic is captured by using wireshark software at the windows end and using tcpdump tool at the linux end, and a target machine network traffic pcap file is generated.

[0073] S11, according to the collected traffic data, bidirectional traffic is divided according to five tuples, and feature extraction is carried out, and traffic feature data is obtained;

[0074] By five tuple division of traffic, each data stream in the network can be uniquely identified, and Trojan traffic often communicates with the control command server in the form of session data stream. Using five tuples for traffic division can be well matched with the form of Trojan traffic, facilitating the model to learn the characteristics of Trojan traffic.

[0075] In addition, by five tuple division, rich traffic space-time information can be included, facilitating sufficient data for feature extraction.

[0076] The features extracted in the application include: average size of reverse data packet of data stream, total time and average time of two data packets before sending of forward and reverse data packets of data stream, average length of flow, total number of bytes of header of forward and reverse data packets of data stream, number of data packets with PUSH field, number of bytes sent in the initial window of reverse data stream, and average time of active state before the flow becomes idle state.

[0077] The application has the following advantages by selecting the above-mentioned features:

[0078] Average size of reverse data packet of data stream: Trojan traffic is different from normal network service traffic, normal traffic is initiated by the client to the server for various requests, while Trojan traffic is usually sent by the victim end to maintain the connection, and the control command server end initiates various requests to the victim end, so the average size of the reverse data packet of Trojan traffic is different from the normal traffic, and should be extracted as a feature.

[0079] Total time and average time of two data packets before sending of forward and reverse data packets of data stream: normal traffic is in the client and server end, generally by the client human operation, the total time and average time of service request generally have no regularity, only related to people. And Trojan traffic, due to its heartbeat behavior for maintaining connection, and some specific attack behavior, the total time and average time of data sending are often related to its specific behavior, and have certain regularity, so they are extracted as features.

[0080] Average length of flow: the total time and average time of sending two data packets in the forward and reverse direction of the data flow, the average length of the flow is often meaningless due to the artificiality and specificity of customer requests. However, the average length of the flow of Trojan traffic can to some extent depict the attack behavior of the Trojan, so it is used as a feature extraction.

[0081] Total number of bytes in the data packet header of the data flow in the forward and reverse directions: normal traffic often has limited use of the data packet header, which is generally of fixed length. Trojan traffic often performs additional operations or padding in the expansion field of the data packet header due to the need to complete data transmission tasks as soon as possible and carry additional information, resulting in differences from normal traffic, so it is used as a feature extraction.

[0082] Number of data packets with PUSH field: normal traffic generally does not use the PUSH field, while Trojan traffic needs to complete attacks and data transmission as soon as possible to improve efficiency, usually enabling the PUSH field in the data packet. It can be used as a judgment point, so it is used as a feature extraction.

[0083] Number of bytes sent in the initial window of the reverse direction of the data flow and average time in the active state before the flow becomes idle: in normal traffic, the number of bytes sent by the server and the average time are often determined by the client and the specific network environment at that time, and have specificity. The active behavior of Trojan traffic mainly depends on the attack rules set by the Trojan in advance, so the number of bytes sent in the initial window of the reverse direction of the data flow and the average time in the active state have certain regularity, so they are used as features for extraction.

[0084] S12, obtaining training set data obtained by processing the traffic feature data, to train a machine learning model using the training set data to obtain a Trojan virus identification model;

[0085] Among them, processing the traffic feature data includes: regular processing of traffic feature data, labeling processing of traffic feature data, and normalization processing of traffic feature data; specifically, it can include:

[0086] For the flow feature comma-separated value (CSV) file of feature extraction, first, code normalization processing is carried out, because in the machine learning model, the maximum depth is set to a specific value 13, the purpose is to strengthen the model to identify the specific value in the extracted feature value of the feature, but because this value exceeds the normal value 10, the model is very likely to produce overfitting, thus leading to the decline of the model recognition ability or even a big discount. Therefore, using the normalization processing can reduce the interference of individual error values in the feature on the specific learning of the model afterwards, increase the performance and stability of the model, and reduce the risk of overfitting.

[0087] In addition, if in the actual environment, some previously extracted features are abnormal or invalid due to specific network environment or human setting, normalization processing of the extracted data can also help the model to select more effective features for class judgment.

[0088] Because we need to identify the concealment mode and the activity stage of the Trojan, the initial data needs to be marked in the code. The marking content includes the corresponding concealment mode and the activity stage of each data. Because the collected data is in the configured Trojan virus environment, but it is inevitable to interact with the outside world, in the process of data marking, other flows unrelated to Trojan flow also need to be screened out according to the previous feature extraction results, to avoid the influence of the data characteristics.

[0089] In addition, because the flow collection process will be affected by network fluctuations and specific network environment, a certain number of specific values will appear, so it is different from the normal machine learning data processing, the present application carries out normalization processing on the flow to avoid the adverse effects of specific values on the model.

[0090] Because the model needs to complete too many classification categories, in order to enable the model to learn more specific features of each category to obtain better classification effect, the present application adjusts the maximum depth in the model parameters from the usual value 3-10 to a specific value 13 to adapt to this new problem.

[0091] In a general normal machine learning model, the maximum depth is often 3-10, in order to avoid the model learning the features with specific values, leading the model to blindly take these specific values or error values as the standard for classifying, thereby causing overfitting. However, due to the large number of classification categories to be completed by the present application and the large difference between different concealment modes, the model needs to learn more detailed feature values for judgment. In addition, since the data is normalized during data processing, overfitting of the model can be avoided to some extent, so the present application uses a value of 13 which is larger than the normal value. In multiple experiments, the effect of using the parameter 13 is the best, so we finally set the value to 13.

[0092] The training set and test set are divided according to the obtained traffic feature data, the training set is input into the machine learning model for parameter training, and a converged and good classification performance Trojan virus identification model is obtained. The trained model is tested for performance using the test set.

[0093] S13, using the Trojan virus identification model to identify the concealment mode and the Trojan activity stage of the Trojan virus.

[0094] The technical effects of the present application will be illustrated by specific experimental data as follows.

[0095] The environment is described as follows: The traffic data is collected on a Windows 10 system. The normal traffic is collected by performing normal network activities on the host, such as web browsing, watching live software, using chat software, etc. The malicious traffic is generated by using the Cobalt Strike software to generate Trojan viruses, which are used as carriers for Trojan generation, and the traffic is generated by cloud function forwarding, VPS proxy forwarding, DNS tunnel, DoH tunnel as concealment mode and C2 server information exchange. The traffic without executing any instructions or only executing sleep instructions (modified Trojan heartbeat period instructions) is used as Trojan silent period traffic, and the traffic executing not less than two instructions (in addition to sleep instructions, at least one instruction) is used as Trojan active period traffic. The machine learning model used is XGBoost. The total accuracy of the experiment is 0.93, and the detailed experimental results are as follows:

[0096] The confusion matrix table of the experiment of Trojan concealment mode and activity stage identification is shown in Table 1 as follows:

[0097] Table 1

[0098]

[0099]

[0100] Note: benign represents normal traffic, scf represents the Trojan horse silent period traffic hidden by cloud functions, vps represents the Trojan horse silent period traffic hidden by VPS forwarding, dns represents the Trojan horse silent period traffic hidden by DNS tunneling, doh represents the Trojan horse silent period traffic hidden by DoH tunneling, scf_cc represents the Trojan horse active period traffic hidden by cloud functions, vps_cc represents the Trojan horse active period traffic hidden by VPS forwarding, dns_cc represents the Trojan horse active period traffic hidden by DNS tunneling, and doh_cc represents the Trojan horse active period traffic hidden by DoH tunneling.

[0101] The specific indicators of the experiment are shown in Table 2 below:

[0102] Table 2

[0103] Class \ Metric Precision Recall F1 -score Support benign 1.00 1.00 1.00 6140 scf 0.77 0.76 0.77 933 vps 0.89 0.76 0.82 933 dns 0.90 0.98 0.94 933 doh 0.96 0.87 0.91 273 scf_cc 0.77 0.84 0.80 933 vps_cc 0.81 0.83 0.82 933 dns_cc 1.00 0.97 0.98 933 doh_cc 0.91 0.94 0.92 273 macro avg 0.89 0.88 0.89 12284 weighted avg 0.93 0.93 0.93 12284

[0104] True Positive (TP): the number of positive classes predicted as positive

[0105] False Positive (FP): the number of negative classes predicted as positive

[0106] False Negative (FN): the number of positive classes predicted as negative

[0107] Precision:

[0108] Recall:

[0109]

[0110] Macro Average (macro avg): arithmetic average for all classes

[0111] Weighted Average (weighted avg): considering the proportion of the number of samples of each class in the total samples (the weight is the proportion)

[0112] Analysis of experimental results:

[0113] From the above indicators and confusion matrix, it can be found that in the multi-classification task of distinguishing the hiding method and the Trojan active stage, the Trojan virus recognition model can perfectly judge the maliciousness of the traffic. There is no false positive and false negative for normal traffic and malicious traffic categories, and the performance is good.

[0114] In summary, the Trojan virus recognition model trained by the present application can effectively identify the maliciousness of the traffic, and can also identify malicious traffic of different hiding methods and different Trojan active periods. To a certain extent, it can complete the task of identifying the malicious traffic hiding method and the Trojan active period set in the experiment.

[0115] The present application solves the problem of identifying various high-concealment modes of Trojans. It can help the defender to specify a more targeted response strategy, take different countermeasures for different hidden modes, and also help the security team to respond to threats more quickly and limit the scope of attack. Finally, the identification of different hidden modes can help the security team to collect information about the attacker, the target of the attack, etc., so as to better understand the threat environment.

[0116] In addition, the present application solves the problem of identifying different Trojan activity stages under various high-concealment modes. Through the identification of different Trojan activity stages, the defender can take specific defense actions for different Trojan activity stages. For example, for the active Trojan, the actual threat can be immediately stopped, and the behavior, strategy and purpose of the attacker during the attack stage can be understood, which helps to improve the defense measures, prevent similar attacks in advance, and because the actual attack behavior is captured, evidence can be obtained to help subsequent legal action. The identification of the silent Trojan can help the security team to better understand the attack path, the target of the attacker and the evolution of attack technology, and to identify and repair vulnerabilities and weaknesses in the system, thereby strengthening the defense mechanism.

[0117] The Trojan virus high-concealment mode and activity stage identification method proposed by the present application has universality. The traffic division and feature extraction method used by the present application does not depend on a specific protocol or field, and can check all the traffic generated on the target machine. Moreover, since the feature extraction does not involve the interpretation of the traffic data packet payload, whether the traffic is encrypted does not affect the identification of the Trojan.

[0118] The present application also provides a Trojan virus identification device, and a structure diagram of the device is shown in Figure 7 The device mainly includes:

[0119] A first unit 70 is configured to configure a Trojan virus environment and collect traffic data in the Trojan virus environment.

[0120] A second unit 71 is configured to divide the collected traffic data according to five-tuple bidirectional traffic and extract features to obtain traffic feature data.

[0121] A third unit 72 is configured to obtain training set data obtained by processing the traffic feature data, train a machine learning model using the training set data, and obtain a Trojan virus identification model. The processing includes normalizing the traffic feature data.

[0122] A fourth unit 73 is configured to identify the concealment mode and the Trojan activity stage of the Trojan virus using the Trojan virus identification model.

[0123] The first unit 70 is configured to configure a Trojan horse environment, including:

[0124] Configure the traffic of information exchange with the command and control server in the stealth mode of at least two Trojan horses.

[0125] Configure Trojan silent period traffic and Trojan active period traffic.

[0126] The first unit 70 is configured to configure a Trojan horse environment, including:

[0127] Modify the connection code in the Trojan control code, so that after the connection is interrupted by the parser, the data is still retransmitted, and the connection with the command and control server is maintained.

[0128] The third unit 72 further includes regular processing and label processing of the traffic feature data.

[0129] The third unit 72 trains the machine learning model using the training set data, including:

[0130] The maximum depth value in the model parameter is adjusted to a specific value 13.

[0131] The second unit 71 extracts features, including:

[0132] The average size of the reverse data packet of the data stream, the total time and the average time before sending two data packets of the data stream forward and reverse, the average length of the flow, the total number of bytes in the header of the data stream forward and reverse data packet, the number of data packets with the PUSH field, and the number of bytes sent in the initial window of the data stream reverse and the average time in the active state before the flow becomes idle.

[0133] As to the device in the above embodiments, the specific manner in which each unit performs the operation has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0134] The above description is only the preferred embodiment of the present application and the explanation of the applied technical principles, and is not intended to limit the scope of the claimed invention, but only represents the preferred embodiment of the present application. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solutions formed by the specific combination of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0135] Various embodiments are described herein with reference to the following terminology, which in each case shall have the meaning indicated below and which are important to the understanding of the present application.

[0136] It is to be understood that the application is not limited to the precise construction herein described and illustrated in the accompanying drawings, and that various modifications and changes can be effected therein by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

[0137] The above description is embodied in the best mode presently contemplated by the inventors. This description is in no way meant to limit or restrict the scope of the application. Any modifications, substitutions, improvements, and the like arising out of the following claims are intended to be embraced by the scope of the application.

Claims

1. A method of detecting a Trojan horse, characterized by, The method comprises: configuring a Trojan environment and collecting traffic data under the Trojan environment; when configuring the Trojan environment, configuring traffic for information exchange with a control and command server in the form of concealment of at least two Trojans, and at the same time, configuring Trojan silent period traffic and Trojan active period traffic; wherein the concealment form of the Trojan comprises cloud function concealment, VPS forwarding concealment, DNS tunnel concealment and DoH tunnel concealment; when configuring the traffic for information exchange with the control and command server in the form of concealment of at least two Trojans, the connection code in the Trojan control code is modified, so that after the connection is interrupted by the parser, the data is still re-sent, and the connection with the command control server is continued; at the same time, a payload length verification function is additionally added to the code for sending data, and the part less than 8 times is filled with "0" characters to ensure the stability of the Trojan; dividing the collected traffic data according to five-tuple bidirectional traffic, and performing feature extraction to obtain traffic feature data; obtaining training set data obtained by processing the traffic feature data, training a machine learning model using the training set data, and obtaining a Trojan virus identification model; wherein the processing comprises normalizing the traffic feature data; using the Trojan virus identification model to identify the concealment form of the Trojan and the Trojan activity stage, distinguishing different concealment forms, and at the same time, identifying different Trojan activity stages in at least two concealment forms.

2. The method of claim 1, wherein, The processing further comprises regular processing of the traffic feature data and labeling processing of the traffic feature data.

3. The method of claim 1, wherein, The step of training a machine learning model using the training set data comprises adjusting the maximum depth value in the model parameters to a specific value of 13.

4. The method of claim 1, wherein, The feature extraction comprises extracting the following features: average size of reverse data packets of a data stream, total time and average time before sending two data packets in the forward and reverse directions of the data stream, average length of the stream, total number of bytes in the header of the forward and reverse data packets of the data stream, number of data packets with PUSH field, and number of bytes sent in the initial window of the reverse direction of the data stream and average time in the active state before the stream becomes idle.

5. A Trojan horse detection apparatus characterized by comprising: comprises: a first unit for configuring a Trojan environment and collecting traffic data under the Trojan environment; when configuring the Trojan environment, configuring traffic for information exchange with a control and command server in the form of concealment of at least two Trojans, and at the same time, configuring Trojan silent period traffic and Trojan active period traffic; wherein the concealment form of the Trojan comprises cloud function concealment, VPS forwarding concealment, DNS tunnel concealment and DoH tunnel concealment; when configuring the traffic for information exchange with the control and command server in the form of concealment of at least two Trojans, the connection code in the Trojan control code is modified, so that after the connection is interrupted by the parser, the data is still re-sent, and the connection with the command control server is continued; at the same time, a payload length verification function is additionally added to the code for sending data, and the part less than 8 times is filled with "0" characters to ensure the stability of the Trojan; The second unit is configured to perform bidirectional traffic division according to a five tuple for the collected traffic data, and perform feature extraction to obtain traffic feature data; The third unit is configured to obtain training set data obtained by processing the traffic feature data, train a machine learning model by using the training set data, and obtain a Trojan virus identification model; wherein the processing includes normalizing the traffic feature data; The fourth unit is configured to identify a hiding manner of the Trojan virus and a Trojan activity stage by using the Trojan virus identification model, distinguish different hiding manners, and simultaneously identify different Trojan activity stages in at least two hiding manners.

6. The apparatus of claim 5, wherein, The features extracted by the second unit include: average size of reverse data packets of the data flow, total time and average time before sending two data packets in the forward and reverse directions of the data flow, average length of the flow, total number of bytes in the header of the forward and reverse data packets of the data flow, number of data packets with a PUSH field, and number of bytes sent in the initial window of the reverse direction of the data flow and average time in the active state before the flow becomes an idle state.

Images