Research on Trojan detection method of computer memory mirroring

摘要

Trojan detection plays an important role in the discovery and treatment of Trojans. Acquisition and analysis of memory mirroring is a new research topic of computer live forensics. Computer forensics often need Trojan detection to determine whether target machine has been controlled. This paper proposed a Trojan detection method based on computer live forensics. Construct probabilistic fuzzy cognitive map(PFCM) through analysis of memory mirroring, use memory mirroring Trojan detection algorithm, calculate the probability of the existence of Trojan. The results showed that this method can effectively determine whether there were Trojan in memory mirroring. Detect Trojans through the analysis of various aspects of memory and numerical computation, proposed method improve the accuracy and reliability of Trojan detection.