Aiming at the problem that more popular network application and more complicated network traffic bring big challenge to current Trojan detecting technique, communication behavior of remote access Trojan(RAT) is analyzed, traffic features' different performance in different communication sub-periods is discussed, and an integrated Trojan detecting model based on period feature statistics is presented. Feature statistics based on sub-periods and whole session(WS) respectively can increase the gap and classification ability of traffic features. The weighted integrated classifier can take full use of each base classifier's advantage and compensate for each other's weaknesses, therefore can strong system's detecting and generalization capability. Experiment result shows that this system can recognize Trojan traffics from many kinds of normal traffic effectively.
展开▼
