The invention discloses a 
Trojan horse detection method based on communication behavior clustering, and belongs to the field of information safety. The unknown 
Trojan horse detection method is excellent in 
feature extraction performance, proper in clustering 
algorithm and high in detection efficiency and accuracy in order to resolve the problems that the existing 
Trojan horse detection technology is low in 
feature extraction capacity, improper in clustering 
algorithm selection and the like. According to the technical scheme, the Trojan horse detection method comprises the steps of extracting a network flow data 
package, recombining a TCP conversation, extracting a Trojan horse reverse connecting feature, an entropy feature, a 
heart beat feature and the like, building a 
feature vector of the TCP conversation and carrying out real-
time clustering on the 
feature vector based on a real-time increment clustering 
algorithm of LSH. According to the difference of communication behavior features of a Trojan horse conversation and normal 
network communication behaviors, the Trojan horse detection method marks the difference of the communication behavior features of the Trojan horse conversation and the normal 
network communication behaviors by combining the statistic analysis and the 
time series analysis technology, guarantees high detection accuracy and a zero 
false alarm rate, lowers the 
false alarm rate, and can effectively carry out real-time detection on the abnormal communication behaviors of a Trojan horse.