Trojan Detection via Session Weight Accumulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect Trojan programs in network communications, leading to high false alarm rates and inability to protect against network-based Trojan attacks.
Innovation Solution
A method and apparatus that detect Trojan activity by monitoring session messages for heartbeat detection frequency and characteristics of control command messages, adjusting a session weight based on these factors, and issuing an alarm when a threshold is reached, thereby distinguishing between normal and Trojan-initiated sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If simple string matching is used to detect Trojan in network communication data, then the detection process is simple and fast, but the false alarm rate is high
Solution Approach 1:
The patent segments the detection process into multiple independent modules: heartbeat detection module, frequency judgment module, control command detection module, and weight recording module. Each module processes specific aspects of the communication data separately, allowing for more precise analysis without requiring complex overall processing, thus maintaining speed while improving accuracy.
Solution Approach 2:
The patent introduces a weight-based scoring dimension to evaluate suspiciousness. Instead of relying solely on simple string matching (one-dimensional), the system accumulates weights from multiple detection dimensions (heartbeat detection, frequency analysis, control command detection) to create a comprehensive risk assessment, thereby reducing false alarms while maintaining detection efficiency.
2Ease of manufacture
If local file characteristic matching is used to detect Trojan, then the detection method is simple, but it can only detect local Trojan and fails to detect network Trojan
Solution Approach 1:
The patent creates a universal detection system that can handle multiple types of Trojan threats (local and network-based) through a single apparatus. The system processes communication data streams and applies multiple detection strategies (heartbeat detection, frequency analysis, control command detection) that are applicable to various Trojan variants, thereby achieving both simplicity and broad adaptability.
3Ease of operation
If static file analysis is used to detect Trojan variants, then the detection approach is straightforward, but it is difficult to detect various variants of Trojan effectively
Solution Approach 1:
The patent transitions from static file analysis to dynamic communication behavior analysis. The system continuously monitors communication data streams in real-time, detecting heartbeat patterns, frequency variations, and control commands as they occur. This dynamic approach allows the system to adapt to various Trojan variants without requiring complex static analysis of each new variant.
Data Source
AI summary
A trojan detection method and device, used to solve the problem in the prior art of being unable to effectively detect a trojan in a network, the method comprising: when a trojan heartbeat is detected in a session, according to whether the trojan heartbeat detection frequency is fixed, increasing the recorded session weight by a corresponding weight and recording the increased weight, and checking whether each packet transmitted from a controlling end to a controlled end complies with the characteristics of a trojan control command packet; if yes, then increasing by a third weight onto the recorded session weight and recording the same, and when the session weight reaches an alarm threshold, generating an alarm to notify that the session is initiated by a trojan. An embodiment of the present invention achieves trojan detection by detecting the packet in the session, thereby the trojan in a network can be detected. The detection to the packet in the session is not simply string matching, thus reducing false alarm rate and effectively detecting the trojan in the network.