30-07-2014 дата публикации
Номер: CN103957205A
Принадлежит:
The invention provides a trojan horse detection method based on terminal traffic. The method comprises the steps of capturing data traffic information, analyzing time period traffic, analyzing uplink data traffic and downlink data traffic of a terminal, conducting approval matching between the data traffic which is analyzed intelligently and communication white list data, and detecting the correctness of a terminal traffic data packet. According to the trojan horse detection method based on the terminal traffic, the situation that when a conventional trojan horse detection means according to existing feature codes, samples, malicious codes and the like in the prior art is used, trojan horses which are highly hidden, incapable of being killed, capable of conducting irregular communication and being injected through system program files and the like can not be found or killed in time is changed; by means of the trojan horse detection method based on the terminal traffic, the terminal data ...
Подробнее