【摘要】 特洛依木马作为一种新型的计算机网络病毒,它比其它病毒所构成对网络环境中计算机信息资源的危害都要大。文章对木马病毒特点和所采用技术方法进行了归纳研究,详细介绍了木马病毒在植入、加载、隐蔽、反清除、信息采集和网络通信等六方面所采用的技术方法;在此基础上,提出了基于多Agent协作实现未知新木马病毒自动识别新方法。该方法利用驻留在局域网各机器监测Agent和网络监测Agent所收集的证据和初步判断,并由协作Agent对这些证据和初步判断进行融合印证并做出最终结论。初步实验结果表明,该方法可以有效发现冰河木马病毒和广外女生木马病毒。更多还原

【Abstract】 Trojan horse ia a new kind computer virus,which makes much damage to computer information resoureces in a local network.This paper makes induction on charcteristics and techniques used in trojan horse virus,and intro-duces these technoques with respect to implanting,auto-loading,stealthy,anti-clearing,information gathering,communica-tion in the trojan horse virus in detail.From there,a new approach based on multi-agent cooperative to realize trojan horse auto-detection is put forward.In this new method,monitor agents in each network computer and network make initial decision based on their evidence,then cooperative agent makes final decision based on the evidence from all monitor agents through data fusion.Initial experiment shows this method is able to detection IceRiver trojan horse and Broadcasting girl trojan hores.更多还原