Abstract:

Trojans inject systems and launch various attacks, such as eavesdropping secret information, tampering with system configuration etc., which threats to system security seriously. A novel anti-Trojan malware mechanism based on characteristic behavior and cosine similarity was proposed. Firstly, according to the initial rules base and application behavior, the mechanism regularized the operations of application, and then, the mechanism invoked rules to judges suspicious behaviors based on current rules base and operational impact. Once the application was considered as Trojan malware, the system would dispatch the appropriate algorithm for processing. The mechanism triggered by sensitive behaviors, and had the active prevention function and self-learning function. The analysis and experiment show the solution can detect Trojan malware effectively.

Key words: Trojan malware, behavior detection, regularization, security