The invention discloses a method and
system for detecting and terminating a
remote control Trojan horse in an
island state based on an ETW event, and relates to the field of network and
information security. In order to solve the defect that high-precision and low-overhead detection and timely termination cannot be carried out on the
remote control Trojan horse in an
island state in the prior art, the technical scheme provided by the invention comprises the following steps of: capturing an ETW event in real time, constructing an
event sequence according to a
process identifier, and extracting characteristics such as reconnection frequency, receiving and transmitting event quantity, receiving and transmitting proportion and memory use; quickly screening out high-confidence Trojan horses through a
threshold model; and constructing an event Markov matrix for other sequences, and inputting the event Markov matrix into a depth detection model to carry out further discrimination, thereby identifying the
remote control Trojan horse in the
island state. If the Trojan horse is judged to be the remote control Trojan horse at any stage, the corresponding process is immediately terminated according to the
process identifier, and alarm information is sent. The method is used for real-time detection and
automatic processing of the remote control Trojan horse in the island state by the terminal host, and the
system safety is improved.