Algebra-Based Behavior Identification of Trojan Horse

Compared with the rapidly developing technology of Trojan hiding, hooking, stealing and anti-removing, the detection and recognition technology grows relatively slowly. Signature code detecting technology requiring mass storage and unable to predict new Trojan, heuristic scanning with high misreporting rate and false rate, this article is proposing algebra to describe and detect the behavior of the Trojan. Specifically, let the node of the lattice denote the status of the Trojan, and the operations in the lattice denote the combination of the behavior of Trojans. Thus, the lattice model supplies a quantitative way to identify the Trojan. Boolean Algebra (BA) and Concept Lattice (CL) are two models that are extended on model construction, identification method, and application. Finally, we present theoretical support and sample implementation process to test the theory and the test result is positive so far.