Abstract:Because of the widespread Trojan, Internet users become more and more vulnerable to the threat of information leakage. Traditional techniques of Trojan detection were classified into two main categories: host-based and network-based. Unfortunately, existing techniques are insufficient and limited, because of the following reasons: (1)only uncover the known Trojan while inefficiently detecting novel samples, (2) should be adjusted in a timely fashion even a trivial change is applied, and (3)become computationally more expensive. In our work, we focus on a network behavior based method to address the limitations of previous network-based approaches. We analyze the profile of network behavior at two levels: (i)flow-level, (ii)IP-level. Our approach present two main advantages: (1)capture more detailed information to describe the network behavior profile, (2)consume lower computational overhead. We proposed a system, Manto, which detects Trojan communication with high accuracy using clustering technique. We implement Manto on real-world traces. The evaluation results exhibit that Manto is suitable for detecting Trojan communication amongst the vast amount of network traffic, with over 91% accuracy and less than 3.2% false positive ratio. We confidently regard our approach as a complementary way to the existing network-based techniques for we could address their main shortcomings.

Design and Implementation of Model for Network Communications Signatures Automatic Generation of Trojan Horses

Use of host's software information to mitigate false positive in signature-based NIDS

Design and Implementation of Network Worm Detection System for Internal Network

DESIGNING AND IMPLEMENTING DISTRIBUTED TROJAN DETECTION SYSTEM

Generation of Trojan communication signatures based on support

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Design of Defense Against Trojan Horse System Based on Restricted Token

A Novel Approach Of Detecting Trojan Based On Network Behavior Analysis

A Model of Trojan Communication Behavior Detection Based on Hierarchical Clustering Technique

Detection of Trojan Horse based on behavior analysis

A General Framework of Trojan Communication Detection Based on Network Traces

A Fast Method of Signature Generation for Polymorphic Worms

Large Scale Network Worm Detection Using Automatic Signature Extraction

Research of Trojan Detection System Based on Artificial Immune

Hamsa: Fast Signature Generation for Zero-day PolymorphicWorms with Provable Attack Resilience

Trojan Detection Using Its Auto-startup Characteristic

Concealing Technology of Trojan Horses and Prevention

Detection of Trojan Covert Communication Based on Client Honeypot

Technique of Detecting Malicious Executables Via Behavioral and Binary Signatures

Prototype demonstration: trojan detection and defense system

Worm Detection and Signature Extraction Based on Communication Characteristics