CN107086978B - Method and device for identifying Trojan horse virus - Google Patents

Abstract

The invention discloses a method and device for identifying a Trojan horse virus, comprising: collecting core network data and billing data, the core network data including signaling data and service data; performing historical habit analysis and periodical analysis on the periodical service data Behavior analysis, and combined with the billing data to identify suspected Trojan-infected users; when it is determined that the business information corresponding to the business data does not belong to the whitelist database but belongs to the blacklist database, add the business data to the suspected Trojan horse behavior event In the table; when it is determined that the business information corresponding to the business data does not belong to the whitelist database and does not belong to the blacklist database, the business data that meets the screening strategy will be added to the suspected Trojan horse behavior event table; the suspected Trojan horse behavior The business data in the event table is centrally analyzed to determine the business data belonging to the Trojan horse, and the business information of the business data belonging to the Trojan horse is added to the blacklist database.

Description

A method and device for identifying Trojan horse virus

technical field

The invention relates to the field of mobile communication, in particular to a method and device for identifying mobile phone Trojan horse viruses through user behavior on the network.

Background technique

With the development of the mobile Internet and the popularization of mobile terminals, especially smart terminals, mobile phone viruses or malicious programs on mobile phones are about to cause a lot of harm. Among all virus types, Trojan horse viruses for the purpose of consuming tariffs, stealing user identity information, transaction information, and payment information account for more than 75%, becoming the most important aspect affecting user information security and economic security.

Mobile phone viruses originated from computer viruses. Following the definition of computer Trojan horses, mobile phone Trojan horses can be defined as: Trojan horses are hidden and spontaneous programs that can be used to perform malicious acts. Most of them will not directly cause harm to mobile phones, but mainly control them.

At present, the discovery and treatment of Trojan viruses are mainly completed through the active installation of security applications (Apps) such as QQ Security Guard, 360 Security Guard, Jinshan Guard, etc. on mobile terminals. Prevention awareness.

Due to the relatively weak prevention awareness and initiative of the middle-aged and elderly user groups, female user groups and other user groups, it is difficult to contain mobile phone Trojan horses based on existing solutions. The harm caused by mobile phone Trojans is also increasing day by day.

In addition, because mobile phone Trojan horse programs have obvious profit-seeking properties, they are even more harmful. The main hazards are as follows:

1. Push advertisements by sending spam messages.

2. Steal user information and conduct blackmail and deception.

3. Illegally customizing various service provider (sp, service provider) services.

4. Use various traps to absorb fees.

In the case that mobile phone users cannot actively defend and check and kill Trojan horses, another subject involved in Trojan horse viruses-operators will also be greatly affected. The harm caused by mobile phone Trojans, such as charging fees and consuming traffic, will generally have an indirect adverse impact on operators through user complaints and off-network. If the operator cannot find out the reason in time, it needs to compensate the user's complaint about the tariff loss, resulting in the loss of economy and brand satisfaction. For this type of problem, existing solutions are more difficult to solve.

Contents of the invention

In order to solve the above technical problems, the embodiments of the present invention provide a method and device for identifying a Trojan horse virus.

The method for identifying Trojan horse virus that the embodiment of the present invention provides, comprises:

collecting core network data and billing data, the core network data including signaling data and service data, performing periodic statistics on the service data to obtain periodic service data;

Performing historical habit analysis and periodic behavior analysis on the periodic business data, and identifying suspected Trojan-infected users in combination with the billing data;

When it is determined that the business information corresponding to the business data does not belong to the whitelist database but belongs to the blacklist database, adding the business data to the suspected Trojan horse behavior event table;

When it is determined that the business information corresponding to the business data does not belong to the whitelist database or the blacklist database, filter the business data according to the screening strategy, and add the business data satisfying the screening strategy to the suspected Trojan horse behavior event table In; the screening strategy is related to the signaling data and the suspected Trojan-infected user;

Centrally analyzing the business data in the suspected Trojan horse behavior event table, determining the business data belonging to the Trojan horse, and adding the business information of the business data belonging to the Trojan horse to the blacklist database.

In the embodiment of the present invention, when it is determined that the business information corresponding to the business data does not belong to the whitelist database but belongs to the blacklist database, the business data is added to the suspected Trojan horse behavior event table, including:

Judging whether the business information corresponding to the business data belongs to the whitelist library;

When it is determined that the business information corresponding to the business data belongs to the whitelist database, no processing is performed;

When it is determined that the business information corresponding to the business data does not belong to the whitelist database, it is determined whether the business information corresponding to the business data belongs to the blacklist database;

When it is determined that the business information corresponding to the business data belongs to the blacklist database, the business data is added to the suspected Trojan horse behavior event table.

In the embodiment of the present invention, the screening strategy includes: a first screening rule, a second screening rule, and a third screening rule; wherein,

The first screening rule refers to: according to the signaling data and the service data, determine the time difference between the networking behavior and the business behavior; according to the time difference, judge whether traffic is generated immediately after networking; if yes, then the The business data satisfies the screening strategy;

The second screening rule refers to: determining an upload event and a download event according to the business data; judging whether a download event is generated immediately after the upload event; if yes, the business data satisfies the screening strategy;

The third screening rule refers to: judging whether the business data belongs to the list of suspected Trojan-infected users, and the suspected Trojan-infected user list is composed of the suspected Trojan-infected users; if yes, the business data meets the screening strategy.

In the embodiment of the present invention, the business data in the suspected Trojan horse behavior event table is centrally analyzed to determine the business data belonging to the Trojan horse, and the business information of the business data belonging to the Trojan horse is added to the black List library, including:

Perform periodic or non-periodic centralized analysis of the business data in the suspected Trojan horse behavior event table to determine whether the business data in the suspected Trojan horse behavior event table is convergent;

For converged business data, it is further judged whether the business data belongs to a Trojan horse according to the verification operation obtained;

When it is determined that the service data belongs to a Trojan horse, the service information of the service data belonging to a Trojan horse is added to the blacklist library.

In an embodiment of the present invention, the method further includes:

When it is determined that the business data belongs to a Trojan horse, the relevant users of the business data belonging to a Trojan horse are added to the list of users suspected of being infected with a Trojan horse;

When it is determined that the service data does not belong to the Trojan horse, the service information of the service data not belonging to the Trojan horse is added to the white list database.

In the embodiment of the present invention, performing historical habit analysis and periodic behavior analysis on the periodic business data, and identifying suspected Trojan-infected users in combination with the billing data includes:

Carry out flow habit analysis, business habit analysis and time habit analysis on historical cycle business data respectively to obtain historical analysis results;

According to the current cycle business data, get the data related to the historical cycle business data based on traffic, business and time, as the current analysis result;

comparing the current analysis result with the historical analysis result, and comparing the current analysis result with the billing data when the current analysis result is inconsistent with the historical analysis result, and when the When the current analysis result does not match the billing data, the suspected Trojan-infected user is identified.

The device for recognizing a Trojan horse virus provided by the embodiments of the present invention includes:

The data module is used to collect core network data and billing data, the core network data includes signaling data and service data, and periodically collects statistics on the service data to obtain periodic service data;

The periodic behavior grouping module is used to perform historical habit analysis and periodic behavior analysis on the periodic business data, and identify users who are suspected of being infected with a Trojan horse in combination with the charging data;

The real-time behavior screening module is used to determine that the business information corresponding to the business data does not belong to the whitelist database and belongs to the blacklist database, and adds the business data to the suspected Trojan horse behavior event table; When the business information does not belong to the whitelist database and does not belong to the blacklist database, the business data is filtered according to the screening strategy, and the business data that meets the screening strategy is added to the suspected Trojan horse behavior event table; the screening strategy and The signaling data is related to the suspected Trojan-infected user; the business data in the suspected Trojan behavior event table is analyzed centrally to determine the business data belonging to the Trojan, and the business data of the business data belonging to the Trojan Information is added to the blacklist library.

In the embodiment of the present invention, the real-time behavior screening module includes:

The whitelist judging module is used to judge whether the business information corresponding to the business data belongs to the whitelist database; when it is determined that the business information corresponding to the business data belongs to the whitelist database, no processing is performed;

The blacklist judging module is used to determine whether the business information corresponding to the business data belongs to the blacklist database when it is determined that the business information corresponding to the business data does not belong to the whitelist database; when it is determined that the business information corresponding to the business data When the information belongs to the blacklist library, the business data is added to the suspected Trojan horse behavior event table.

In the embodiment of the present invention, the real-time behavior screening module includes:

A filtering strategy module, configured to filter the business data according to the filtering strategy when it is determined that the business information corresponding to the business data does not belong to the whitelist database or the blacklist database, and add the business data satisfying the filtering strategy To the suspected Trojan horse behavior event table; the screening strategy is related to the signaling data and the suspected Trojan-infected user;

Wherein, the screening strategy includes: a first screening rule, a second screening rule, and a third screening rule; wherein,

The first screening rule refers to: according to the signaling data and the service data, determine the time difference between the networking behavior and the business behavior; according to the time difference, judge whether traffic is generated immediately after networking; if yes, then the The business data satisfies the screening strategy;

The second screening rule refers to: determining an upload event and a download event according to the business data; judging whether a download event is generated immediately after the upload event; if yes, the business data satisfies the screening strategy;

The third screening rule refers to: judging whether the business data belongs to the list of suspected Trojan-infected users, and the suspected Trojan-infected user list is composed of the suspected Trojan-infected users; if yes, the business data meets the screening strategy.

In the embodiment of the present invention, the real-time behavior screening module includes:

The centralized analysis module is used to perform periodic or aperiodic centralized analysis on the business data in the suspected Trojan horse behavior event table to determine whether the business data in the suspected Trojan horse behavior event table converges; for For the converged business data, further judge whether the business data belongs to a Trojan horse according to the obtained verification operation; when it is determined that the business data belongs to a Trojan horse, add the business information of the business data belonging to a Trojan horse to the blacklist library.

In the embodiment of the present invention, the centralized analysis module is also used to add the relevant users of the business data belonging to the Trojan horse to the list of users suspected of being infected with the Trojan horse when it is determined that the business data belongs to the Trojan horse; When it is determined that the business data does not belong to the Trojan horse, the business information of the business data that does not belong to the Trojan horse is added to the white list library.

In the embodiment of the present invention, the periodic behavior grouping module includes:

The historical habit analysis module is used to conduct flow habit analysis, business habit analysis and time habit analysis on historical cycle business data respectively, and obtain historical analysis results;

The periodic behavior analysis module is used to obtain data related to historical periodic business data based on traffic, business and time according to the current periodic business data, as the current analysis result;

A comparison module, configured to compare the current analysis result with the historical analysis result, and compare the current analysis result with the billing data when the current analysis result does not match the historical analysis result Comparison, when the current analysis result does not match the billing data, then identify the suspected Trojan-infected user.

In the technical solution of the embodiment of the present invention, core network data and billing data are collected, and the core network data includes signaling data and service data, and periodic statistics are performed on the service data to obtain periodic service data; Perform historical habit analysis and periodic behavior analysis on business data, and identify suspected Trojan-infected users in combination with the billing data; when it is determined that the business information corresponding to the business data does not belong to the whitelist database and belongs to the blacklist database, the Business data is added to the suspected Trojan horse behavior event table; when it is determined that the business information corresponding to the business data does not belong to the whitelist database or the blacklist database, the business data is filtered according to the screening strategy, which will satisfy the screening The business data of the strategy is added to the suspected Trojan horse behavior event table; the screening strategy is related to the signaling data and the suspected Trojan infected user; the business data in the suspected Trojan horse behavior event table is analyzed centrally to determine Get the business data belonging to the Trojan horse, and add the business information of the business data belonging to the Trojan horse to the blacklist database. It can be seen that the embodiment of the present invention identifies whether the user is infected with a Trojan horse virus by monitoring the behavior of the user in the network. Provides important security protection measures for the middle-aged, elderly and female groups with weak security awareness, ensuring the security of user information. In addition, it is also of great significance for operators to use big data, improve user perception, and maintain a network security environment.

Description of drawings

Fig. 1 is the schematic flow chart of the method for identifying Trojan horse virus of the embodiment of the present invention;

Fig. 2 is a schematic diagram of the core network interface of networks such as 2/3/G and LTE;

Fig. 3 is a schematic diagram of the structural composition of the device for identifying a Trojan horse virus according to an embodiment of the present invention, as shown in Fig. 3;

FIG. 4 is a schematic flow diagram of each module in the device for identifying a Trojan virus according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of the relationship between modules in the device for identifying a Trojan horse virus according to an embodiment of the present invention.

Detailed ways

In order to understand the characteristics and technical contents of the embodiments of the present invention in more detail, the implementation of the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. The attached drawings are only for reference and description, and are not intended to limit the embodiments of the present invention.

The technical solution of the embodiment of the present invention is mainly based on information such as user business behavior data collected in the mobile communication network, billing system data, user package data, etc., and identifies whether the mobile phone of the user is attacked by a Trojan horse virus through the user's behavior.

Fig. 1 is the schematic flow sheet of the method for identifying Trojan horse virus of the embodiment of the present invention, as shown in Fig. 1, described method for identifying Trojan horse virus comprises the following steps:

Step 101: Collect core network data and charging data, the core network data includes signaling data and service data, perform periodic statistics on the service data, and obtain periodic service data.

In the embodiment of the present invention, the data collection system based on the core network interface performs data collection. As shown in FIG. 2 , FIG. 2 is a schematic diagram of core network interfaces of networks such as 2/3/G and LTE. Here, for the core network interface, in General Packet Radio Service (GPRS, General Packet Radio Service), Time Division Synchronous Code Division Multiple Access (TD-SCDMA, TimeDivision-Synchronous Code Division Multiple Access), Wideband Code Division Multiple Access (WCDMA, Wideband Code Division Multiple Access), Time Division Duplex LTE (TDD-LTE), and Frequency Division Duplex LTE (FDD-LTE) networks are applicable.

Step 102: Perform historical habit analysis and periodic behavior analysis on the periodical business data, and identify suspected Trojan-infected users in combination with the billing data.

Specifically, the traffic habit analysis, business habit analysis and time habit analysis are respectively performed on the historical cycle business data to obtain the historical analysis results;

According to the current cycle business data, get the data related to the historical cycle business data based on traffic, business and time, as the current analysis result;

comparing the current analysis result with the historical analysis result, and comparing the current analysis result with the billing data when the current analysis result is inconsistent with the historical analysis result, and when the When the current analysis result does not match the billing data, the suspected Trojan-infected user is identified.

Step 103: When it is determined that the business information corresponding to the business data does not belong to the whitelist database but belongs to the blacklist database, add the business data to the suspected Trojan horse behavior event table.

Specifically, it is judged whether the business information corresponding to the business data belongs to the whitelist database;

When it is determined that the business information corresponding to the business data belongs to the whitelist database, no processing is performed;

When it is determined that the business information corresponding to the business data does not belong to the whitelist database, it is determined whether the business information corresponding to the business data belongs to the blacklist database;

When it is determined that the business information corresponding to the business data belongs to the blacklist database, the business data is added to the suspected Trojan horse behavior event table.

Step 104: When it is determined that the business information corresponding to the business data does not belong to the whitelist database or the blacklist database, filter the business data according to the screening strategy, and add the business data satisfying the screening strategy to the suspected Trojan horse In the behavior event table; the screening strategy is related to the signaling data and the suspected Trojan-infected user.

The screening strategy includes: a first screening rule, a second screening rule, and a third screening rule; wherein,

The first screening rule refers to: according to the signaling data and the service data, determine the time difference between the networking behavior and the business behavior; according to the time difference, judge whether traffic is generated immediately after networking; if yes, then the The business data satisfies the screening strategy;

The second screening rule refers to: determining an upload event and a download event according to the business data; judging whether a download event is generated immediately after the upload event; if yes, the business data satisfies the screening strategy;

The third screening rule refers to: judging whether the business data belongs to the list of suspected Trojan-infected users, and the suspected Trojan-infected user list is composed of the suspected Trojan-infected users; if yes, the business data meets the screening strategy.

Step 105: Perform centralized analysis on the business data in the suspected Trojan horse behavior event table, determine the business data belonging to the Trojan horse, and add the business information of the business data belonging to the Trojan horse to the blacklist database.

Specifically, perform periodic or non-periodic centralized analysis on the business data in the suspected Trojan horse behavior event table to determine whether the business data in the suspected Trojan horse behavior event table is convergent;

For converged business data, it is further judged whether the business data belongs to a Trojan horse according to the verification operation obtained;

When it is determined that the service data belongs to a Trojan horse, the service information of the service data belonging to a Trojan horse is added to the blacklist library.

In the embodiment of the present invention, when it is determined that the business data belongs to a Trojan horse, the relevant users of the business data belonging to the Trojan horse are added to the list of users suspected of being infected with a Trojan horse;

When it is determined that the service data does not belong to the Trojan horse, the service information of the service data not belonging to the Trojan horse is added to the white list database.

Fig. 3 is a schematic diagram of the structural composition of the device for identifying a Trojan horse virus according to an embodiment of the present invention. As shown in Fig. 3, the device includes:

The data module 31 is used to collect core network data and billing data, the core network data includes signaling data and service data, and periodically collects statistics on the service data to obtain periodic service data;

The periodic behavior grouping module 32 is used for performing historical habit analysis and periodic behavior analysis on the periodic business data, and identifying suspected Trojan-infected users in combination with the billing data;

The real-time behavior screening module 33 is used to determine that when the business information corresponding to the business data does not belong to the whitelist database and belongs to the blacklist database, add the business data to the suspected Trojan horse behavior event table; determine that the business data When the corresponding business information does not belong to the whitelist database and does not belong to the blacklist database, the business data is filtered according to the screening strategy, and the business data satisfying the screening strategy is added to the suspected Trojan horse behavior event table; the screening strategy Related to the signaling data and the suspected Trojan-infected user; perform centralized analysis on the business data in the suspected Trojan-horse behavior event table, determine the business data belonging to the Trojan horse, and store the business data belonging to the Trojan horse Business information is added to the blacklist library.

Described real-time behavior screening module 33 comprises:

A whitelist judging module 331, configured to judge whether the business information corresponding to the business data belongs to a whitelist database; when it is determined that the business information corresponding to the business data belongs to a whitelist database, no processing is performed;

The blacklist judging module 332 is used for judging whether the business information corresponding to the business data belongs to the blacklist database when it is determined that the business information corresponding to the business data does not belong to the whitelist database; When the business information belongs to the blacklist library, the business data is added to the suspected Trojan horse behavior event table.

Described real-time behavior screening module 33 comprises:

A screening strategy module 333, configured to filter the business data according to the screening strategy when it is determined that the business information corresponding to the business data does not belong to the whitelist database or the blacklist database, and the business data satisfying the screening strategy Added to the suspected Trojan horse behavior event table; the screening strategy is related to the signaling data and the suspected Trojan infected user;

Wherein, the screening strategy includes: a first screening rule, a second screening rule, and a third screening rule; wherein,

The first screening rule refers to: according to the signaling data and the service data, determine the time difference between the networking behavior and the business behavior; according to the time difference, judge whether traffic is generated immediately after networking; if yes, then the The business data satisfies the screening strategy;

The second screening rule refers to: determining an upload event and a download event according to the business data; judging whether a download event is generated immediately after the upload event; if yes, the business data satisfies the screening strategy;

The third screening rule refers to: judging whether the business data belongs to the list of suspected Trojan-infected users, and the suspected Trojan-infected user list is composed of the suspected Trojan-infected users; if yes, the business data meets the screening strategy.

Described real-time behavior screening module 33 comprises:

The centralized analysis module 334 is used to perform periodic or aperiodic centralized analysis on the business data in the suspected Trojan horse behavior event table to determine whether the business data in the suspected Trojan horse behavior event table is converged; For converged business data, further judge whether the business data belongs to a Trojan horse according to the verification operation obtained; when it is determined that the business data belongs to a Trojan horse, add the business information of the business data belonging to a Trojan horse to the blacklist library .

The centralized analysis module 334 is also used to add the relevant users of the business data belonging to the Trojan horse to the list of suspected Trojan-infected users when it is determined that the business data belongs to a Trojan horse; If it does not belong to the Trojan horse, add the service information of the service data that does not belong to the Trojan horse to the white list database.

Described periodic behavior grouping module 32 comprises:

The historical habit analysis module 321 is used to respectively perform flow habit analysis, business habit analysis and time habit analysis on historical cycle business data to obtain historical analysis results;

The periodic behavior analysis module 322 is used to obtain data related to historical periodic business data based on traffic, business and time according to the current periodic business data, as the current analysis result;

A comparison module 323, configured to compare the current analysis result with the historical analysis result, and compare the current analysis result with the billing data when the current analysis result is inconsistent with the historical analysis result comparison, and when the current analysis result does not match the billing data, the suspected Trojan-infected user is identified.

Fig. 4 is the flowchart interaction schematic diagram of each module in the device of identifying Trojan horse virus of the embodiment of the present invention, as shown in Fig. 4:

1), data module

This module mainly provides the data required by the solution, which is mainly divided into two parts: core network acquisition system data and billing system data.

The data of the core network collection system is divided into two types: signaling data and business data.

Signaling data refers to the 2/3G user establishment of the Packet Data Protocol (PDP, Packet Data Protocol) context, and the 4G attach (Attach), bearer establishment and other processes, mainly reflecting the behavior and time of the user connecting to the network.

Business data refers to data such as which websites users visit, how much traffic they generate, and how long the business lasts. It mainly reflects the behavior and time of users using the business.

On the basis of business data, periodic statistics of user's business data can be obtained by specifying a cycle for statistics, that is, periodic business data, which mainly reflects the user's periodic business behavior.

The billing system data mainly provides information about the user’s package, especially the order and change of the data service package.

2) Real-time behavior screening module

This module is mainly based on real-time data to complete quasi-real-time screening of suspected Trojan records and periodic centralized analysis of suspected Trojan records.

The main process of this module is described as follows.

After the real-time user's business data is input, the whitelist judging module compares the business name and destination IP of the business behavior with the whitelist database to determine whether the business name and destination IP of the business are normal.

If the business name and destination IP of this business belong to the white list library, then do not do any processing and continue to the processing work of the next record.

If the service name and destination IP of this service do not belong to the whitelist library, then enter the blacklist judgment module for comparison. It is necessary to complete the operation of judging whether the service name and destination IP of this service belong to the blacklist database.

If the business name and destination IP of this business belong to the blacklist library, then add this record to the suspected Trojan horse behavior event table and leave it for subsequent centralized analysis.

If the business name and destination IP of this business do not belong to the blacklist library, the filtering work needs to be completed through the screening strategy, and the records satisfying the filtering strategy are added to the suspected Trojan horse behavior event table.

The screening strategy is defined based on the behavior of mobile phones after being attacked by Trojan horse viruses. Now there are three main points.

The first screening rule: Networking generates traffic. The main reason is that many Trojan horse viruses control (or monitor) the behavior of the attacked mobile phone to connect to the Internet, and then upload stolen data or download more virus plug-in operations. Screening is mainly based on the time difference between the user's networking behavior and business behavior. The setting of the time difference can be obtained through experience or statistics. According to experience, the time difference is 500-1000ms, which needs to be shorter than the user's operation time. The time difference used for statistics is obtained by analyzing the distribution range of the value, usually through the deciles.

The second screening rule: the upload behavior is followed by the download behavior. This is also defined according to the behavior of many Trojan horse viruses. Many Trojan horse viruses not only delete the private information of mobile phone users, but also automatically update and download more malicious programs, and the general order is to upload first and then download. This rule is judged by the user's business behavior data, and the upload and download behavior is judged by the HTTP POST/GET information and the size ratio of the upstream and downstream packets.

The third screening rule: the user belongs to the list of suspected Trojan-infected users. The list of suspected Trojan-infected users is generated through the periodic behavior analysis module, which is the third main module.

These screening rules have an effect on one or more records, and add the single or multiple records satisfying the rules to the suspected Trojan horse behavior event table.

Based on the suspected Trojan horse behavior event data, centralized analysis can be performed periodically or irregularly (satisfying a certain amount of records), and the convergence of these records in terms of business names and destination IPs can be analyzed.

If it is found that there is a centralized business name or destination IP, then a manual verification operation is performed to confirm whether it is related to a Trojan horse. After some of the previous processes, the workload that requires manual confirmation is not large, generally on the order of 100 per day.

Finally, after manual confirmation, those belonging to the Trojan business and destination IP are added to the blacklist library, and the relevant users are added to the list of suspected Trojan-infected users; business names and destination IPs that have nothing to do with the Trojan horse are added to the whitelist library. Thus, one cycle of the module is completed.

3) Periodic behavior grouping module

This module mainly completes the identification and output tasks of users suspected of being infected with Trojan horses by performing operations such as historical habit analysis, periodic behavior analysis, and comparison between the periodic business data.

Historical habit analysis module: mainly analyze the Internet habits in three aspects: traffic, business, and time through the historical cycle business data (distinguish from the current cycle). These habits all come from several aspects of user behavior changes after the Trojan horse virus invades the user's mobile phone.

1> Traffic habit: refers to statistical indicators such as the average value, standard deviation, and coefficient of variation of the user's upstream and downstream traffic in the analysis period, reflecting the user's habits such as the level of traffic usage and the magnitude of traffic changes. Based on this habit, users can be divided into stable high-traffic users, stable low-traffic users, and fluctuating traffic users. This analysis angle comes from the impact of Trojan viruses on user traffic.

2> Business habits: refers to the names and rankings of the TOPN services with high traffic volume in the analysis period. Generally, 10 services are selected as the investigation objects. It can also be determined according to the distribution of the number of services of normal users to determine how many services are used as the investigation object. The data organization form of the analysis process is a vector, and the user's business stability is represented by the center of gravity and distance between vectors. Users can be divided into two types: stable and fluctuating. This analysis angle comes from the impact of advertising and automatic download Trojan horse viruses on users.

3> Time habits: refers to the distribution of users' online time. Generally, the time in a cycle is grouped by working day/non-working day, business busy time/business free time, and the same time interval, so that the continuous time variable is changed into a discrete variable. On this basis, the average value, standard deviation, coefficient of variation and other indicators of the user's traffic and duration are counted to obtain the user's time habits. The perspective of this analysis comes from the impact on users of privacy-stealing, advertising, and automatic downloading Trojan horses, either at regular intervals or very random access control.

Periodic behavior analysis module: This module mainly obtains the data of the current period, and obtains the data structure related to the historical habit analysis module in dimensions such as traffic, business, and time.

Comparison module: It mainly performs the comparison of the current cycle behavior and habits, and the comparison of the current cycle and the change of the package when the current cycle is different from the habit.

1> Comparison of current period behavior and habits: Through the comparison of current period data and habit data, it is found whether the user's current period behavior has changed, the extent of change, the time point of change, etc. and data.

2> Comparison with the package when the current period is different from the habit: When the user's current period behavior does not match the habit, the user package, especially the change of the data service package in the natural month of the current period, is tested. If the package also changes similarly to the user's business behavior, such as a sudden increase in user traffic and a corresponding increase in the data package, it is considered that the abnormal behavior of the user is caused by the package, so no processing is performed. If the package does not change or does not match the change in user behavior, the user is added to the list of suspected Trojan-infected users for use by the real-time behavior screening module.

FIG. 5 is a schematic diagram of the relationship between modules in the device for identifying a Trojan horse virus according to an embodiment of the present invention. As shown in FIG. 5 , 1 and 2 represent: provide data. 3 means: provide a list of users suspected of being infected with a Trojan horse, that is, a list of users suspected of being infected with a Trojan horse.

The specific contents of the files involved in the embodiments of the present invention are as follows:

Whitelist database: a collection of business names and destination IPs, the representatives in the collection have nothing to do with Trojan horse viruses.

Blacklist library: A collection of business names and destination IPs. Representatives in the collection are related to Trojan horse viruses, distribution sites of Trojan horse viruses, control IPs, infected applications, and advertising sites that earn clicks, etc.

List of suspected Trojan-infected users: The list of users with a high probability of being attacked by Trojan horse viruses can be used in customer service, business support and other departments for reference in customer service and business blocking.

User list infected with Trojan horse: Confirm the list of users who have been infected by Trojan horse virus. It can support active care, network management, service management, network optimization and other work.

The technical solutions described in the embodiments of the present invention may be combined arbitrarily if there is no conflict.

In the several embodiments provided by the present invention, it should be understood that the disclosed methods and smart devices can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be fully integrated into a second processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention.

Claims (12)

1. a method of identifying a trojan horse virus, the method comprising:

Collecting core network data and charging data, wherein the core network data comprises signaling data and service data, and periodically counting the service data to obtain periodic service data; the charging data provides package conditions of the user;

performing historical habit analysis and periodic behavior analysis on the periodic service data, and identifying suspected infected Trojan horse users by combining the charging data;

When the business information corresponding to the business data is judged not to belong to a white list library and belongs to a blacklist library, adding the business data to a suspected Trojan behavior event table;

When the business information corresponding to the business data is judged not to belong to the white name list library and not to belong to the black name list library, filtering the business data according to a screening strategy, and adding the business data meeting the screening strategy into a suspected Trojan behavior event table; the screening strategy is related to the signaling data and the suspected infected Trojan horse user;

And carrying out centralized analysis on the service data in the suspected Trojan horse behavior event table to determine the service data belonging to the Trojan horse, and adding the service information of the service data belonging to the Trojan horse to the blacklist library.

2. The method according to claim 1, wherein when it is determined that the service information corresponding to the service data does not belong to a whitelist library and belongs to a blacklist library, adding the service data to a suspected Trojan horse behavior event table includes:

Judging whether the service information corresponding to the service data belongs to a white list library or not;

When the business information corresponding to the business data is judged to belong to the white list library, no processing is carried out;

when the business information corresponding to the business data is judged not to belong to the white list library, judging whether the business information corresponding to the business data belongs to the black list library or not;

and when the service information corresponding to the service data is judged to belong to the blacklist library, adding the service data to a suspected Trojan behavior event table.

3. the method for identifying Trojan horse viruses according to claim 1, wherein the screening strategy comprises: a first screening rule, a second screening rule, a third screening rule; wherein,

the first screening rule is that: determining the time difference between the networking behavior and the service behavior according to the signaling data and the service data; judging whether the flow is generated immediately after networking according to the time difference; if yes, the service data meets the screening strategy;

The second screening rule is that: determining an uploading event and a downloading event according to the service data; judging whether an uploading event is generated and then a downloading event is generated; if yes, the service data meets the screening strategy;

The third screening rule is that: judging whether the service data belongs to a suspected infected Trojan horse user list, wherein the suspected infected Trojan horse user list is composed of suspected infected Trojan horse users; if yes, the service data meets the screening strategy.

4. the method according to claim 3, wherein the performing a centralized analysis on the business data in the suspected Trojan horse behavior event table to determine the business data belonging to the Trojan horse, and adding the business information of the business data belonging to the Trojan horse to the blacklist library comprises:

Carrying out periodic or aperiodic centralized analysis on the service data in the suspected Trojan horse behavior event table to judge whether the service data in the suspected Trojan horse behavior event table is converged;

for the converged service data, further judging whether the service data belongs to the Trojan horse or not according to the obtained verification operation;

and when the business data is judged to belong to the Trojan horse, adding the business information of the business data belonging to the Trojan horse to the blacklist library.

5. The method of identifying Trojan horse viruses of claim 4, further comprising:

When the business data are judged to belong to the Trojan horse, adding the relevant users of the business data belonging to the Trojan horse to the suspected infected Trojan horse user list;

and when the business data are judged not to belong to the Trojan horse, adding the business information of the business data not belonging to the Trojan horse to the white list library.

6. The method for identifying Trojan horse viruses according to any one of claims 1 to 5, wherein the performing historical habit analysis and periodic behavior analysis on the periodic business data and the identifying suspected Trojan horse infected users by combining the billing data comprises:

Respectively carrying out flow habit analysis, service habit analysis and time habit analysis on historical periodic service data to obtain a historical analysis result;

Obtaining data related to historical periodic service data based on flow, service and time according to the current periodic service data, and taking the data as a current analysis result;

comparing the current analysis result with the historical analysis result, comparing the current analysis result with the charging data when the current analysis result is not consistent with the historical analysis result, and identifying a suspected infected Trojan horse user when the current analysis result is not consistent with the charging data.

7. An apparatus for identifying a Trojan horse virus, the apparatus comprising:

The data module is used for acquiring core network data and charging data, the core network data comprises signaling data and service data, and the service data is periodically counted to obtain periodic service data; the charging data provides package conditions of the user;

the periodic behavior clustering module is used for performing historical habit analysis and periodic behavior analysis on the periodic service data and identifying suspected infected Trojan horse users by combining the charging data;

The real-time behavior screening module is used for adding the business data into a suspected Trojan behavior event table when judging that the business information corresponding to the business data does not belong to a white list library and belongs to a blacklist library; when the business information corresponding to the business data is judged not to belong to the white name list library and not to belong to the black name list library, filtering the business data according to a screening strategy, and adding the business data meeting the screening strategy into a suspected Trojan behavior event table; the screening strategy is related to the signaling data and the suspected infected Trojan horse user; and carrying out centralized analysis on the service data in the suspected Trojan horse behavior event table to determine the service data belonging to the Trojan horse, and adding the service information of the service data belonging to the Trojan horse to the blacklist library.

8. the apparatus for identifying Trojan horse virus according to claim 7, wherein the real-time behavior screening module comprises:

the white list judging module is used for judging whether the service information corresponding to the service data belongs to a white list library; when the business information corresponding to the business data is judged to belong to the white list library, no processing is carried out;

The blacklist judging module is used for judging whether the service information corresponding to the service data belongs to a blacklist library or not when the service information corresponding to the service data is judged not to belong to a whitelist library; and when the service information corresponding to the service data is judged to belong to the blacklist library, adding the service data to a suspected Trojan behavior event table.

9. The apparatus for identifying Trojan horse virus according to claim 7, wherein the real-time behavior screening module comprises:

The screening strategy module is used for filtering the service data according to a screening strategy when the service information corresponding to the service data is judged not to belong to a white list library and not to belong to a black list library, and adding the service data meeting the screening strategy into a suspected Trojan behavior event table; the screening strategy is related to the signaling data and the suspected infected Trojan horse user;

wherein the screening strategy comprises: a first screening rule, a second screening rule, a third screening rule; wherein,

The first screening rule is that: determining the time difference between the networking behavior and the service behavior according to the signaling data and the service data; judging whether the flow is generated immediately after networking according to the time difference; if yes, the service data meets the screening strategy;

the second screening rule is that: determining an uploading event and a downloading event according to the service data; judging whether an uploading event is generated and then a downloading event is generated; if yes, the service data meets the screening strategy;

The third screening rule is that: judging whether the service data belongs to a suspected infected Trojan horse user list, wherein the suspected infected Trojan horse user list is composed of suspected infected Trojan horse users; if yes, the service data meets the screening strategy.

10. the apparatus for identifying Trojan horse virus according to claim 9, wherein the real-time behavior screening module comprises:

The centralized analysis module is used for periodically or non-periodically performing centralized analysis on the service data in the suspected Trojan horse behavior event table to judge whether the service data in the suspected Trojan horse behavior event table is converged; for the converged service data, further judging whether the service data belongs to the Trojan horse or not according to the obtained verification operation; and when the business data is judged to belong to the Trojan horse, adding the business information of the business data belonging to the Trojan horse to the blacklist library.

11. The apparatus for identifying Trojan horse virus according to claim 10, wherein the centralized analysis module is further configured to add the relevant users of the business data belonging to Trojan horse to the list of suspected infected Trojan horse users when the business data is determined to belong to Trojan horse; and when the business data are judged not to belong to the Trojan horse, adding the business information of the business data not belonging to the Trojan horse to the white list library.

12. the apparatus for identifying Trojan horse virus according to any one of claims 7 to 11, wherein the periodic behavior clustering module comprises:

the historical habit analysis module is used for respectively carrying out flow habit analysis, business habit analysis and time habit analysis on historical periodic business data to obtain a historical analysis result;

the periodic behavior analysis module is used for obtaining data related to historical periodic service data based on flow, service and time according to the current periodic service data and taking the data as a current analysis result;

And the comparison module is used for comparing the current analysis result with the historical analysis result, comparing the current analysis result with the charging data when the current analysis result is not consistent with the historical analysis result, and identifying a suspected infected Trojan horse user when the current analysis result is not consistent with the charging data.