Detecting Rebound Port Trojan Based on Network Behavior Analysis
Bo Zhang · Xinxi wangluo anquan · 2011
The communicating process of rebound port Trojan is analyzed firstly, then the network behavior model of rebound port Trojan is constructed and the PACKET-CLUSTER concept with formalization description is proposed. Three network behavior characteristics of Trojan heartbeat and six network behavior characteristics of Trojan operation are proposed. Finally the implement methods are proposed. The experimental results show that our method can efficiently detect rebound port Trojan.