基于Linux的未知木马检测系统研究及实现

针对传统木马检测方法对未知木马识别能力低下的缺陷,结合行为监控和人工免疫学,建立并实现了一个基于Linux的未知木马检测系统。该系统具备自主检测和自学习功能,结合内容检测,利用网络监控检测局域网内部计算机的木马存在情况。实验测试表明,该系统降低了检测的漏报率,具有良好的检测效果。

Unknown Trojan Linux-based Detection System Research and Realization

According to the defects of the traditional technology of the detection of the Trojan,combination of behavior monitoring and artificial immune,established and implemented a Linux-based detection system of unknown Trojan.The system has self-monitoring and self-learning function,combined with content inspection,used within the LAN network monitoring detected the presence of local area network computer Trojan horse.Experimental tests show that the system reduces the omission rate,have good detection results.