关键词: 木马检测, 网络流量分析, 特征分析, 远控型木马

Abstract: As a stealing tool, Trojans are often used in APT(Advanced Persistent Threat) attacks, which causes a serious hazard to the security of cyberspace. The detection of Trojans has also received extensive attention from researchers. At present, researchers have proposed many detection methods based on network traffic analysis. However, these methods generally need to analyze complete communication traffic, so it will cause certain detection delay and cause that the defense measures cannot be deployed in time. In order to protect the internal sensitive information from being leaked as early as possible, this paper analyzes the traffic characteristics of the Trojan communication and extracts the traffic features from the first five packets after the communication being established, and then constructs a rapid detection model of Trojan communication session. The experimental results show that the proposed method obtains higher accuracy and lower false positive rate when analyzing the early data of communication, which verifies the effectiveness of the proposed method.

Key words: Trojan detection, network traffic analysis, characteristics analysis, remote access Trojan