Research on Anti-Trojan Malware Mechanism Based on Characteristic Behavior

Weifu Zou; Yiying Zhang; Suxiang Zhang; Chengyue Yang

doi:10.3969/j.issn.1000-0801.2014.11.018

您当前的位置：

首页 >

文章列表页 >

Research on Anti-Trojan Malware Mechanism Based on Characteristic Behavior

research and development | 更新时间：2024-06-05

- Research on Anti-Trojan Malware Mechanism Based on Characteristic Behavior
- DIANXIN KEXUE Vol. 30, Issue 11, Pages: 105-109(2014)
- 作者机构：
  
  1. 国网泉州供电公司泉州 362000
  2. 国家电网公司信息通信分公司北京 100761
  3. 南瑞集团公司厦门亿力吉奥信息科技有限公司厦门 361009
- 作者简介：
- 基金信息：
- DOI：10.3969/j.issn.1000-0801.2014.11.018
  CLC：
- Published Online：2014-11，
  
  Published：20 November 2014
- 稿件说明：
移动端阅览
Weifu Zou, Yiying Zhang, Suxiang Zhang, et al. Research on Anti-Trojan Malware Mechanism Based on Characteristic Behavior[J]. Dianxin kexue, 2014, 30(11): 105-109.
DOI：

Weifu Zou, Yiying Zhang, Suxiang Zhang, et al. Research on Anti-Trojan Malware Mechanism Based on Characteristic Behavior[J]. Dianxin kexue, 2014, 30(11): 105-109. DOI： 10.3969/j.issn.1000-0801.2014.11.018.

摘要

摘要：基于木马病毒行为特性，提出基于数据挖掘的相似度技术的主动木马病毒检测及预防算法，从规则化、行为过滤及自学习3个方面保证算法的完备性和有效性。首先，依据木马病毒特征码及特征行为，进行特征的规则化，建立初始木马病毒规则库。其次，建立进程行为特征捕捉及分析过程，采用聚类分析方法，完成行为特征规则化。最后，通过对比规则库及相似度主动对比法，完成对可疑进程的分析对比，确定可疑进程性质。分析及实验表明该算法具有自主学习及主动防御特征，很好地平衡了静态测试技术和动态测试技术的优缺点。

Abstract

Trojans inject systems and launch various attacks

such as eavesdropping secret information

tampering with system configuration etc.

which threats to system security seriously. A novel anti-Trojan malware mechanism based on characteristic behavior and cosine similarity was proposed. Firstly

according to the initial rules base and application behavior

the mechanism regularized the operations of application

and then

the mechanism invoked rules to judges suspicious behaviors based on current rules base and operational impact. Once the application was considered as Trojan malware

the system would dispatch the appropriate algorithm for processing. The mechanism triggered by sensitive behaviors

and had the active prevention function and self-learning function. The analysis and experiment show the solution can detect Trojan malware effectively.

关键词

Keywords

references

国家计算机病毒应急处理中心 . 第十二次全国信息网络安全状况与计算机及移动终端病毒疫情调查分析报告 . http://www. antivirus-china.org.cn http://www. antivirus-china.org.cn , 2013

韩宇 , 申永军 . 特洛伊木马隐藏技术分析．微计算机信息 , 2012 , 28 ( 1 ): 128 ～ 129

蔺聪 , 黑霞丽 . 木马的植入与隐藏技术分析．信息安全与通信保密 , 2008 ( 7 ): 53 ～ 55

张复生 . 基于广谱通信行为分析的木马检测技术研究．重庆邮电大学硕士学位论文 , 2011

Liu D . Analysis on hiding technologies of Trojan hors ． China Science and Technology Information , 2010 , 1 ( 1 ): 112 ～ 113

付文 , 魏博 , 赵荣彩 . 基于模糊推理的程序恶意性分析模型研究．通信学报 , 2010 , 31 ( 1 ): 44 ～ 50

李家骥 . 计算机木马攻击与检测技术研究及实现．电子科技大学硕士学位论文 , 2011

李鹏 , 王汝传 . 基于自相似特性的恶意代码动态分析技术．南京邮电大学学报 ( 自然科学版 ), 2012 , 32 ( 3 ): 86 ～ 90

邢云冬 , 刘胜利 . 木马网络通信特征提取模型的设计与实现．计算机工程与设计 , 2010 , 31 ( 20 ): 4382 ～ 4384,4446

程文聪 . 面向大规模网络安全态势分析的时序数据挖掘关键技术研究．国防科学技术大学博士学位论文 , 2010

何鸿君 , 罗莉 , 董黎明等 . 广义病毒的形式化定义及识别算法．计算机学报 , 2010 , 33 ( 3 ): 562 ～ 568

Views

1552

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A survey on 5G capabilities enabling the factories of the future

Interconnection and coexistence of heterogeneous network:requirements, challenges, and architecture

A lightweight and trusted communication protocol for IoT

Joint amplitude and phase partition based physical layer key generation method

Research and practice of mobile application lifecycle management platform

Related Author

Jinhui TANG

Yusun FU

Zhiyuan WANG

Shan ZHANG

Hongbin LUO

Juanna DANG

Fei YANG

Guanwen LI

Related Institution

Key Laboratory of System Control and Information Processing, Ministry of Education of China

Shanghai Engineering Research Center of Intelligent Control and Management

School of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University

Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing

Key Laboratory of Mathematics, Information and Behavioral Semantics, MoE

⁰