Similarity and self-learning based anti-Trojan Mechanism

摘要

Trojans inject systems and launch various attacks, such as eavesdropping secret information, tampering with system configuration etc., which threats to system security seriously. In this paper, a novel anti-Trojan malware mechanism was proposed based on attribute behaviour and cosine similarity. Firstly, according to the initial rules base and application behaviour, the mechanism regularized the operations of application, and then, the mechanism invoked rules to judges suspicious behaviours based on current rules base and operational impact. Once the application was considered as Trojan malware, the system would dispatch the appropriate algorithm for processing. The mechanism triggered by sensitive behaviours, and had the active prevention function and self-learning function. The analysis and experiment show the solution can detect Trojan malware effectively.