The invention discloses a
Trojan horse detection method based on communication behavior clustering, and belongs to the field of information safety. The unknown
Trojan horse detection method is excellent in
feature extraction performance, proper in clustering
algorithm and high in detection efficiency and accuracy in order to resolve the problems that the existing
Trojan horse detection technology is low in
feature extraction capacity, improper in clustering
algorithm selection and the like. According to the technical scheme, the Trojan horse detection method comprises the steps of extracting a network flow data
package, recombining a TCP conversation, extracting a Trojan horse reverse connecting feature, an entropy feature, a
heart beat feature and the like, building a
feature vector of the TCP conversation and carrying out real-
time clustering on the
feature vector based on a real-time increment clustering
algorithm of LSH. According to the difference of communication behavior features of a Trojan horse conversation and normal
network communication behaviors, the Trojan horse detection method marks the difference of the communication behavior features of the Trojan horse conversation and the normal
network communication behaviors by combining the statistic analysis and the
time series analysis technology, guarantees high detection accuracy and a zero
false alarm rate, lowers the
false alarm rate, and can effectively carry out real-time detection on the abnormal communication behaviors of a Trojan horse.