Trojan Attack Prevention Technology

Trojan has great destructivity ,can be easily hidden,has become one of the main method to attack computer information systems. Trojans have brought much more serious damages and losses of information .It has made great threaten to the security of computer information systems,so the research of anti-trojan has already become the hotspot and the main emphasis in the area of information security.In the thesis,Trojan was thorough researched and analyzed. The main work done as follows:1.We summarize the conception,the main characteristic,the infect method,the notice method of Trojan Horse.2.We analyze the hide mechanism of Trojan in Windows systems. We analyze thorough the hide mechanism of Trojan in run-form,communicate-form,startup-form and the file in host disk.3.We analyze the hide mechanism of BO2K and Nethief Trojan,give emphasis on the hide mechanism of the BO2K in run-form and Nethief in communicate-form in allusion to the firewall.4.We analyze the limits of the popular detecting method of Trojan Horse by static characteristics,point out that the detecting method of Trojan has the drawback to detect for the unknown Trojan, can not detect them ,can not adapt to the confront-detect techniques for the known Trojan.The bility to detect Trojan depends on the static characteristics warehouse of Trojan in the detection system.5.At the basis of research on the hide mechanism of Trojan and detecting method of Trojan by static characteristics,we give a Trojan intrusion detection-defence system framework based on dynamic behavior of Trojan and static characteristics of Trojan。Based on the detect-defence method of Trojan by static characteristics and by the dynamic behavior,it implements the defense of Trojan by controlling the resources of the infection,hide and malice action of Trojan,implements the detecting of Trojan by watching the Registry,the system file and system directory,the map between port and process and the call of suspect Windows API ,and by filtering the communication information of system.