Trojan Attack Prevention Theory And Research

With the rapid popularization of the Internet and the constant development of its application, various kinds of Internet attack methods have also appeared. These attacks have seriously damaged the interests of the Internet users. Among these attacks, Trojan horse has been a rather popular one because of its extensive range of attack, the disguise for the self-protection and the enormous harmfulness.In this paper, we firstly point out some basic ideas of the Trojan horse which include its definition, principle, classification and the development trends. We introduce some techniques about its implantation, auto-loading, disguise, anti-cleaning, and its applications in the Internet communication. The methods of its auto-running in windows operating system platform are also discussed in this paper, and the crucial fractions of its realization is presented. Then, we study the methods of how to realize the disguise of the process through process injection, and give a new way to disguise the Trojan horse process. We present the definition of the secret channel in the Internet, and systematically study the Trojan horse communication techniques based on the secret channel. By the introduction to the current detection methods of Trojan Horse, we then present a Trojan Horse detection algorithm on the basis of correlated analysis of time-frequency, and make a test of the algorithm to the real Trojan horse. The result of our test shows that our algorithm is effective. Some tactics and techniques against the intrusion of the Trojan horse are also studied in this paper, which have instructing meaning to prevent the intrusion of the Trojan horse, recover from the damages the Trojan Horse has caused and strengthen the security of the InternetSome related work of this paper have been supported by the program of the security techniques of net management and by the study of information security and related mathmatic theory. We have got several basic results, but how to realize the detection and obstruction of the secret channel, and the auto-cleaning of the Trojan program are something need more study.