摘要
在Windows环境下,针对现有木马检测软件在对抗多态性木马和未知木马等方面的不足,提出了协同检测思想,并给出木马协同检测的形式化模型。在此模型中,定义了木马行为特征库,利用贝叶斯公式计算木马概率;同时,利用协同检测方案对抗木马的多态变形,从而提高了检测木马的准确率。与传统的检测方法相比,该方案的优点是能有效地检测已知木马的多态变形体以及新出现的木马,且具有较高的准确率。
Aim at the shortcomings of the existed detection technologies of Trojan horses on Windows system, a new scheme of cooperative detection between Trojan horses, is presented and its formal model is proposed in this paper. In this model, Trojan horse＇s behavior character database is defined at first, and then Trojan horse probabihty is calculated by Bayes＇theorem. In addition, cooperative detecting scheme coping with polymorphic Trojan horse is adopted to enhance its abilities of detection. Compared with traditional detective methods, the mainly merit of the scheme is detecting effectively not only known Trojan horses but also unknown ones, and having higher accuracy.
出处
《机电一体化》
2008年第9期35-38,共4页
Mechatronics
基金
国防基础科研项目(C2720061361)
关键词
木马
多态
行为特征
协同检测
trojan horse polymorph behavior character cooperative detection
