The Trojan Horse Detection Technology Based on Support Vector Machine

Abstract

This paper presents a Trojan-detection system model based on Support Vector Machine. First, while monitoring the system, this strategy establish system call sequences in accordance with its system calls function in the system, and convert into supporting vector machine-readable tags, and place in the data warehouse for support vector machine extracted as the feature vectors. And to determine the abnormal behavior of testing procedures to determine whether it is Trojan by classifying the detected program behaviors based on the support vector machine classifier. Experimental results show that, comparing with the existing technology of Trojan horse detection, this method has better performance in detection time and detection of known and unknown Trojan horse attacks. Besides, it has higher accuracy, and takes up very little system resource.