67 results about "Trojan horse" patented technology

The invention discloses a Trojan analysis method and device, and relates to the technical field of safety protection. The method comprises the following steps: acquiring a Trojan file, and detecting an entropy value of each character in a Trojan file code; dividing the Trojan file into an encrypted part and a non-encrypted part in the Trojan file based on the entropy value of each character according to a preset entropy value range; determining a corresponding decryption algorithm based on entropy values of characters in the encrypted part; and decrypting the encrypted part by using the decryption algorithm to obtain a plaintext code. The method and the device are used for realizing a Trojan analysis function.

The invention relates to the technical field of computers, and discloses an ecological compensation data value-oriented hierarchical security policy and hierarchical cloud storage system.The method comprises the steps that firstly, security isolation of a virtual network is ensured, technologies such as a virtual network security group and a virtual firewall are adopted, and communication between virtual machines and communication between the virtual machines and an external network are limited; reducing potential attack surfaces, performing security detection on virtual machine images in a resource pool, including verifying integrity and credibility of the images, scanning malicious software, ensuring that image files do not contain known viruses, Trojan horses or malicious software, monitoring behaviors of virtual machines in the resource pool, and using an intrusion detection system (IDS) or a behavior analysis technology. Abnormal behavior, malicious activity or potential security threats are detected. According to the method, the particularity and the security requirement of a virtualization environment are considered specially for the construction requirement of the computing power network security resource pool. According to the method, security risks related to the computing power network can be detected and evaluated more accurately, and the comprehensiveness is high.

The application discloses a Trojan horse virus detection device and method, and belongs to the technical field of information security. The application first finds that the Trojan horse virus may steal information by controlling a computer loudspeaker to emit ultrasonic signals, and proposes the Trojan horse virus detection device and method in light of the finding. The ultrasonic signals emitted by the computer loudspeaker are collected, and then filtered and amplified. The processed ultrasonic signals are decoded to obtain corresponding spectrum information and further analyzed. If the signal peak values all exceed a preset threshold value within a preset sampling period, it is determined that the device to be detected is invaded by the Trojan horse virus. In this way, the application can effectively detect the Trojan horse virus which steals the information stored in the device to be detected by controlling the loudspeaker of the device to be detected to emit ultrasonic signals, and is beneficial to maintaining the information security of the device.

A method for detecting a Trojan horse in a suspicious software application in the form of at least one electronic file, comprising: on a computing device, determining the source from which a suspicious software application was obtained; comparing the source from which the suspect software application was obtained with a source from which a clean original version of the software application was obtained; and, If the sources differ, determining that the suspicious application probably contains a Trojan horse.

The invention discloses a Trojan horse process detection method and device. The Trojan horse process detection method and device are used for solving the problem that a Trojan horse process with a hidden kernel module as a back door is difficult to recognize. According to the method, the Trojan horse program can be effectively identified, and the kernel module assisting the Trojan horse program in hiding traces can be accurately positioned. The method comprises the steps of obtaining a process file of each to-be-detected process from a memory of a system; determining an identifier of a target kernel module corresponding to any to-be-detected process according to the process file of any to-be-detected process; when any one to-be-detected process meets a first condition, determining that any one to-be-detected process is a Trojan horse process; wherein the first condition comprises that the target kernel module is determined to be the kernel module hidden in the system based on the identifier.

The invention provides a Trojan threat intelligence acquisition method and device, electronic equipment and a storage medium, and relates to the technical field of Trojan threat identification. The method comprises the following steps: determining key features of a first Trojan family based on a first connectivity coefficient ratio of the first Trojan family to each feature type; wherein the first connectivity coefficient ratio is a capability value, used for representing the distinction degree between the first Trojan family and other Trojan families, of each feature type; and searching based on the key features to obtain potential Trojan threat intelligence of the first Trojan family. According to the scheme, based on the first connectivity coefficient ratio, rapid positioning of the key features of the first Trojan family is realized, so that the mining production efficiency of Trojan threat intelligence can be improved.

A satellite-borne safety intelligent computing system is used for guaranteeing safety of a satellite edge computing system and comprises a host processor, an AI accelerator and a safety bus connected with the host processor and the accelerator. The satellite-borne safe intelligent computing system further comprises a bus stream encoding and decoding engine which is embedded in the interface controller of the data bus and used for encrypting and decrypting transmission data of the data bus. By encrypting the cache stream on the data bus, key data such as Bias bias cache and the like can be protected. In addition, an attacker can be prevented from stealing structural information of the neural network model through interrupt signals by interrupting obfuscated codes, dual protection of'signal + data 'is formed, and time sequence detection Trojan horse and side channel attacks can be effectively resisted.

The present disclosure describes various embodiments of hardware trojan triggering (HTT) signal analysis. As such, an exemplary method comprises capturing switching activity of nodes for a design of an integrated circuit during a simulation of an application of a test pattern to the design; identifying one or more nodes in a graphical representation of the design that do not toggle within an individual window of time across multiple windows of time; determining unique paths that can be formed by the identified nodes within each of the multiple windows of time; determining one or more unique paths that occur across consecutive windows of time; appending the one or more unique paths that occur across consecutive windows of time in a set; and outputting the one or more unique paths in the set as rare trojan horse triggering paths for the design. Other systems and methods are also presented.

The invention relates to the technical field of mobile terminal safety monitoring, and discloses a risk signal screening monitoring method and system for a mobile terminal. The method comprises the following steps: collecting intensity change sequences of various risk signals of the mobile terminal, calculating cosine similarity and propagation momentum factors of deviation rate vectors, counting time sequence mutual information of the risk signals to determine a causal propagation relationship, constructing a directed propagation graph to predict a future risk evolution value, and calculating the risk evolution value of the mobile terminal. And calculating a weighted distance, dynamically adjusting a judgment threshold and judging a multi-step progressive attack. The technical problems that in the prior art, staged progressive attacks cannot be recognized, risk evolution cannot be pre-judged in advance, the detection sensitivity cannot be adaptively adjusted, and the response strategy is extensive and single are solved. According to the method and the device, the recognition accuracy and the response timeliness of the multi-step progressive Trojan horse attack are improved.

The invention relates to an industrial control system real-time monitoring method, in particular to an industrial control system real-time monitoring method based on illumination side channel analysis, and belongs to the technical field of industrial control system safety monitoring. The implementation method comprises the following steps of: 1, constructing a mapping relation between a normal state operation instruction set and a digital signal, wherein the mapping relation is used for industrial control system acquisition; further obtaining a digital signal set; 2, constructing and training a multi-classification neural network model; 3, applying the trained multi-classification neural network model to actual illumination signal acquisition and monitoring of the industrial control system; when the classification result of the actual illumination signal is not matched with the normal operation instruction set, an alarm is given abnormally; 4, repeating the step 3 to carry out continuous real-time industrial control system monitoring; compared with the prior art, the method physically isolates a monitoring system from an industrial control system and utilizes real-time monitoring to solve the problems of low attack frequency and difficulty in capturing Trojan viruses and the like, and machine learning is combined for monitoring and screening, so that the monitoring efficiency and accuracy are improved.

The invention discloses a quantitative analysis method and device for hardware Trojan key node and path characteristics, a medium and equipment. The quantitative analysis method comprises the following steps: performing quantitative analysis on 0, 1 distribution probability characteristics of each LUT initialization vector based on information entropy; driving a suspicious Trojan horse module by automatically generating a script to obtain a behavior list file, and analyzing the behavior list file to count the number of times of overturning of the signal in the simulation process to obtain a low-overturning signal and a corresponding security attribute; constructing a directed graph; smoothing the distribution of the signal overturning times in an interpolation mode, converting node overturning times data after smoothing into a dictionary structure, and constructing a three-dimensional continuous distribution network of the signal overturning times in combination with a directed graph; according to the method, static structure characteristics and dynamic behavior analysis can be fused, node overturning characteristics are quantized through information entropy, and suspicious Trojan units are accurately positioned.

The invention provides an attack detection method using a naive Bayes classifier in a honeypot. The method comprises an active trapping honeypot and an active verification cloud sandbox. The active trapping honeypot is realized by an active trapping honeypot system; the active trapping honeypot system comprises a host layer, a service layer, an event layer, a data model layer and a detection layer. The active verification cloud sandbox is used for analyzing and discriminating 0DAY and NDAY vulnerabilities widely adopted in network attacks by using codes and special Trojan horses, and discovering intrusion behaviors. By applying the technical scheme, the attack detection capability of the naive Bayes classifier in a honeypot environment can be improved, so that a more effective protection means is provided for network security.

The invention provides a financial data processing method and system, and relates to the technical field of financial data processing. Comprising a data acquisition module, a data storage module, a data security extraction module, a data processing module, a trend analysis module, a risk prediction module, a user side storage module, a user side display module, a security login module and a cloud data storage recovery module, comprising transaction records, market quotation data, customer information and the like; and the data storage module is responsible for safely and reliably storing the collected data into a database. The system has the advantages that the dynamic code is generated in real time through the dynamic verification code generation module in the working process, so that the data extraction module can perform data extraction only when the data in the data storage module is extracted according to the verification code, and data leakage caused by stealing the data in the system by viruses such as crawlers and Trojan horses is avoided.

The embodiment of the invention provides a Trojan horse fishing detection method and device. The false alarm rate of Trojan horse fishing detection can be reduced. The method can comprise the steps that first feature information, second feature information and third feature information of a target application program which is started and runs are extracted, the first feature information is used for indicating the number of icon resources of the target application program, and the second feature information is used for indicating the suspiciousness of icons of the target application program; the third feature information is used for indicating the suspiciousness of the file name of the target application program; on the basis of the first feature information, the second feature information and the third feature information, Trojan horse fishing detection is conducted on the target application program, a detection result is obtained, and the detection result comprises whether the target application program is a Trojan horse fishing or a normal application program.

A method, device, and detection method for constructing an early detection model of remote control Trojan horse traffic based on a convolutional neural network, which relate to the technical fields of network and information security, intrusion detection, and deep learning. It solves the problem that there is an urgent need for an early detection system for remote control Trojan horse traffic that can detect a small amount of traffic at the initial stage of its operation, while meeting the fixed-size input of the convolutional neural network model and avoiding information loss caused by byte truncation or image compression. The method includes: obtaining TCP traffic samples and performing preprocessing, obtaining traffic data and constructing a data set; setting a threshold for the number of packets sent by a port, and extracting the TCP header and payload byte sequences within the threshold range; constructing a set of Markov matrices according to the TCP header and payload byte sequences; training the set of matrices using a deep learning model to obtain an early detection model for remote control Trojan horse traffic. The present invention is applied to the field of detecting network and information security.

The present application provides a Trojan horse killing method, device, electronic device and computer-readable storage medium. Among them, the method includes: executing one or more Trojan horses processed in a specified manner in an anti-virus environment; obtaining the target Trojan horse among the one or more Trojan horses that have not been killed; performing decompilation processing on the target Trojan horse to determine the function data address of the target Trojan horse; determining the decryption algorithm and the first key of the function data according to the function data address; decrypting the encrypted target Trojan horse according to the decryption algorithm and the first key; and killing the decrypted target Trojan horse. It can improve the ability to kill Trojan horses.

1. Name of the product in this design: Small Trojan Horse. 2. Purpose of this design: For children to play with. 3. The key design feature of this product is its shape. 4. The image or photograph that best illustrates the design's key points: a 3D model. 5. The bottom surface of this product is a part that is not easily seen or cannot be seen during use, so the bottom view is omitted.

The invention aims to solve the technical problems that nodes in a trusted network do not depend on the support of any third party, whether a node system environment of the opposite party is trusted or not can be absolutely and accurately verified, and when the trusted nodes are connected with each other, a decentralized trusted machine technology (citation of a basic technology with a patent application number of 2020111511913) is utilized, so that the reliability of the trusted nodes is improved. A detector and a verifier are automatically and dynamically generated, the detector sends the result to an opposite host for operation, and if the operation result is completely consistent with the execution result of the verifier of the host, the opposite system environment passes verification and can be trusted, and whether a node system environment is trusted or not is generally detected, so that a very large risk challenge exists. Even if the Trojan horse virus exists in a system environment, the Trojan horse virus is extremely easy to be cheated and interfered by Trojan horse hackers, particularly rootkit cheating, because whether the Trojan horse virus exists in the system environment or not cannot be predicted before a detector is executed, and if the Trojan horse virus exists, whether the current detector can absolutely identify the Trojan horse virus or not is an uncertain problem. The method is a method for absolutely and accurately verifying whether the opposite node system environment is credible or not, once the verification method is established, a great contribution is made to the block chain main network technology, and the block chain main network can run in an absolutely credible private network environment.

The invention discloses a deep learning Trojan horse detection method, and relates to the field of network security. The method comprises the following steps: firstly, selecting a specified layer of a to-be-detected deep learning model as a detection object, introducing random noise into input data to reduce an overfitting risk, and then generating initial feature intermediate representation of a corresponding category through a feature extraction function; then, combining a classification objective function and a regular term to construct an optimization model, and solving by utilizing a gradient descent method to obtain an optimal feature intermediate representation of the specified layer and a corresponding optimal objective function value; and finally, calculating a Trojan horse detection index BTc based on the obtained target function value, and judging whether the category corresponding to the model has a Trojan horse hidden danger or not by comparing the BTc with a preset threshold value. According to the method, the adaptability of the detection accuracy and the original task of the model is considered, and a safety protection barrier is built for the deep learning model.

The embodiment of the invention discloses a file processing method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining a target file hash value and target file signature data corresponding to a to-be-detected target file, extracting a target message digest from the target file signature data, and sending the target message digest to a server; and performing signature verification on the target file based on the target message digest, determining that the signature verification of the target file is passed, and performing white utilization signature behavior verification on the target file based on the hash value of the target file and the target message digest to obtain a white utilization signature behavior verification result. And performing Trojan horse processing on the target file based on the white utilization signature behavior detection result.

The invention discloses a method and a device for detecting data traffic returned by secret stealing Trojan horses, and belongs to the field of information security. The method comprises the following steps: based on a preset configuration file, monitoring reading of sensitive files by each process and calling of encrypted APIs by each process of Hook in real time, and recording encrypted API calling information of each process; wherein the configuration file contains an encrypted API to be Hooked and a sensitive file to be monitored, and the encrypted API calling information at least comprises a calling sequence of the encrypted APIs, and names, parameters and return values of the encrypted APIs; when the read sensitive file exceeds a set threshold value, intercepting a data packet sent by the process; and performing reverse decryption on the intercepted data packet based on the encrypted API calling information of the process so as to identify the sensitive information stolen by the secret stealing Trojan horse. According to the scheme, the data packet can be quickly decrypted, and potential sensitive information leakage can be found and prevented in time by monitoring reading of the sensitive file.

The invention provides an information-leakage-free quantum dialogue method based on Grover quantum search, so that two communication parties realize mutual exchange of secret messages by utilizing transmission of quantum signals. According to the method, the auxiliary initial two-particle product state is directly transmitted from one user to the other user, so that the problem of information leakage is eliminated. Security analysis proves that the method can resist interception-retransmission attacks, measurement-retransmission attacks, entanglement-measurement attacks and Trojan horse attacks initiated by external eavesdroppers. According to the method provided by the invention, the quantum bit efficiency is up to 2 / 3 after the eavesdropping detection process is ignored. According to the method, only the product state of the two particles is used as an initial quantum resource, only single particle measurement is needed, and quantum entanglement swapping does not need to be executed.

The invention discloses a Trojan virus detection method and device in the Internet field, and the method comprises the steps: configuring a Trojan virus environment, and collecting flow data in the Trojan virus environment; carrying out bidirectional flow division on the collected flow data according to a quintuple, and carrying out feature extraction to obtain flow feature data; obtaining training set data obtained by processing the traffic feature data, and training a machine learning model by using the training set data to obtain a Trojan virus recognition model; wherein the processing comprises the following steps of: performing normalization processing on the traffic characteristic data; and utilizing the Trojan virus identification model to identify the hiding mode and Trojan activity stage of the Trojan virus. According to the method, the flow of the Trojan horse is detected, the hiding mode of the Trojan horse is locked and the activity stage of the Trojan horse is identified under the condition of high hiding.

The present invention provides a method and apparatus for determining a Trojan horse, including: analyzing a first file using a first neural network model to obtain a first analysis result; analyzing a first session using a second neural network model to obtain a second analysis result; determining whether the first file is a Trojan horse file and whether the first session is a session based on the Trojan horse file according to the first analysis result and the second analysis result. Through the present invention, the problem of low accuracy in WebShell Trojan horse detection is solved.

The invention provides a mining Trojan identification method and related equipment, which are used for improving the mining Trojan identification accuracy. The method comprises the steps of obtaining a target CPU instruction corresponding to target software, wherein the target CPU instruction represents a behavior related to the mining Trojan horse; if the number of the target CPU instructions is larger than a first threshold value, collected data corresponding to the target CPU instructions are determined, and the collected data comprise process type event data corresponding to the target CPU instructions and domain name system DNS type event data corresponding to the target CPU instructions. And according to the collected data, identifying a mining Trojan behavior corresponding to the target software.

The invention discloses a method and system for detecting and terminating a remote control Trojan horse in an island state based on an ETW event, and relates to the field of network and information security. In order to solve the defect that high-precision and low-overhead detection and timely termination cannot be carried out on the remote control Trojan horse in an island state in the prior art, the technical scheme provided by the invention comprises the following steps of: capturing an ETW event in real time, constructing an event sequence according to a process identifier, and extracting characteristics such as reconnection frequency, receiving and transmitting event quantity, receiving and transmitting proportion and memory use; quickly screening out high-confidence Trojan horses through a threshold model; and constructing an event Markov matrix for other sequences, and inputting the event Markov matrix into a depth detection model to carry out further discrimination, thereby identifying the remote control Trojan horse in the island state. If the Trojan horse is judged to be the remote control Trojan horse at any stage, the corresponding process is immediately terminated according to the process identifier, and alarm information is sent. The method is used for real-time detection and automatic processing of the remote control Trojan horse in the island state by the terminal host, and the system safety is improved.

1. The name of the design product: computer check graphical user interface for electronic equipment. 2. The use of the design product: for an electronic device. 3. The design points of the design product: in the graphical user interface. 4. The picture or photo that best indicates the design points: design 1 front view. 5. Other views are conventional designs, and other views are omitted. 6. Design 1 is designated as the basic design. 7. The use of the graphical user interface: this interface is used for computer physical examination, Trojan horse killing, memory cleaning, system repair. Design 1 interface change state diagram is the interface presented after clicking "one-key cleaning" in design 1 front view. Design 2 interface change state diagram is the interface presented after clicking "quickly kill" in design 2 front view. Design 3 interface change state diagram is the interface presented after clicking "one-key repair" in design 3 front view. Design 4 interface change state diagram is the interface presented after clicking "quickly kill" in design 4 front view.

The application discloses a chip Trojan horse test set generation method based on vulnerability analysis, which comprises the following steps: first, a register transfer level (RTL) code of a circuit is used to obtain a chip layout result, and a chip layout information point set is obtained from the chip layout result; then, a layout space margin and a routing channel margin after chip layout wiring is completed are analyzed to obtain a chip layout vulnerability matrix; and finally, a vulnerable point in the chip layout vulnerability matrix is selected for hardware Trojan horse implantation to generate a chip layout level hidden hardware Trojan horse test set. The application analyzes physical resources such as a layout space margin and a routing channel margin of a chip layout, analyzes power consumption characteristics of the chip layout on the basis, designs a vulnerability index of the chip layout, selects a vulnerable point, and obtains a chip layout hidden by a hardware Trojan horse, namely, a chip Trojan horse test set. The application promotes the development of a hardware Trojan horse detection technology and improves the defense capability of a chip.

The invention relates to the technical field of network security, and discloses a network security situation prediction method and system based on artificial intelligence, and the method comprises the following steps: implanting controllable Trojan horse data in user-side-oriented software in a mode of uploading network data; the data acquisition module is used for acquiring hardware information data of bearing software and software state data oriented to a user side based on the data acquisition module; and extracting feature vectors of the hardware information data and the software state data, and evaluating the safety coefficient of the controllable Trojan horse data by a third party. According to the method, the authorized Trojan with controllable behaviors and hidden fingerprints is actively implanted in a real software environment for attack and defense drilling, and the passive mode that traditional security detection depends on historical attack characteristics or a static rule base is overturned, so that attack clues of unknown threats and advanced persistent threats can be sensed and found in advance; and the predictability of the system for potential risks is greatly improved.