The Detection of Trojan Horse Based on the Data Mining
Shugang Tang · 2009
Trojan horse is a serious security threat to computer network. Traditionally, Trojan Horses are detected using file's dynamic characteristics or behaviors. However, these methods are not available for unknown or un-awakened Trojan horses. Trojan horse always exists as PE (Portable Executable) file format in the Windows system environment, and the PE file has many static characteristics, which contains many runtime characteristics. In this paper, a new detecting method based on PE file's static attributes is proposed, and intelligent information processing techniques are used to analyze those static attributes, such as decision tree, BP network and Finite State Machine. Further, a detection model is established to estimate whether a PE file is a Trojan horse. This thesis is prepared to value the static Trojan characteristic and build a new way to detect the Trojan horse by using the PE file static characteristics.