摘要： 对比传统木马检测技术的原理及特点，根据网络数据流检测木马的需求，提出一种基于网络通信特征分析的木马识别方法。引入通信指纹的概念扩展通信特征的外延，用实验方法归纳木马在连接、控制和文件传输阶段表现出的通信指纹信息，设计并实现一个启发式木马网络通信指纹识别系统。测试结果表明，该系统运行高效、检测结果准确。

关键词: 木马识别, 通信指纹, 启发式, 深度包检测, 数据流

Abstract: This paper discusses the trojan detection technique, and a detail contrast research of related characters is given. In order to provide trojan detection based on network data flow, a trojan identification method based on network communication fingerprint is broutht forward. The concept of communication fingerprint is introduced to expand the extension of the communication features. Through the experimental method the fingerprints information of trojan for each phase such as connection, control and file transfer can be highlighted. On that basis, a heuristic identification system for trojan based on network communication fingerprint is designed and implemented. Test results indicate that the system runs efficient and the results are accurate.

Key words: trojan identification, communication fingerprint, heuristic, Deep Packet Inspection(DPI), data flow

中图分类号: 

• TP309