《计算机应用》唯一官方网站 ›› 2026, Vol. 46 ›› Issue (10): 3215-3226.DOI: 10.11772/j.issn.1001-9081.2025091099

• 网络空间安全 • 上一篇    

基于流量分析的远程控制木马检测方法综述

张斌1,2, 汪文勇1,3(), 朱启勋4, 邱家徐1, 张家禾1, 廖聪慧4, 廖梓宇1   

  1. 1.电子科技大学 计算机科学与工程学院,成都 611731
    2.中国电信股份有限公司四川分公司,成都 610041
    3.澳门科技大学 下一代互联网国际研究院,澳门 999078
    4.四川通信科研规划设计有限责任公司,成都 610041
  • 收稿日期:2025-09-25 修回日期:2026-01-21 接受日期:2026-02-04 发布日期:2026-04-02 出版日期:2026-10-10
  • 通讯作者: 汪文勇
  • 作者简介:张斌(1989—),男,山西晋中人,高级工程师,博士,主要研究方向:网络流量分析、终端识别、业务识别
    朱启勋(1990—),男,四川成都人,硕士研究生,主要研究方向:终端识别、业务识别
    邱家徐(2001—),男,四川内江人,硕士研究生,主要研究方向:网络流量分析、恶意流量检测
    张家禾(2001—),男,河南新乡人,硕士研究生,主要研究方向:网络流量分析、恶意流量检测
    廖聪慧(1998—),女,四川内江人,主要研究方向:网络流量分析、安全识别
    廖梓宇(2001—),男,四川绵阳人,硕士研究生,主要研究方向:恶意流量检测。

Survey of remote access Trojan detection methods based on traffic analysis

Bin ZHANG1,2, Wenyong WANG1,3(), Qixun ZHU4, Jiaxu QIU1, Jiahe ZHANG1, Conghui LIAO4, Ziyu LIAO1   

  1. 1.School of Computer Science and Engineering,University of Electronic Science and Technology of China,Chengdu Sichuan 611731,China
    2.Sichuan Branch of China Telecom Company Limited,Chengdu Sichuan 610041,China
    3.International Institute of Next Generation Internet,Macau University of Science and Technology,Macau 999078,China
    4.Sichuan Communication Research Planning and Design Company Limited,Chengdu Sichuan 610041,China
  • Received:2025-09-25 Revised:2026-01-21 Accepted:2026-02-04 Online:2026-04-02 Published:2026-10-10
  • Contact: Wenyong WANG
  • About author:ZHANG Bin, born in 1989, Ph. D., senior engineer. His research interests include network traffic analysis, device identification, service identification.
    ZHU Qixun, born in 1990, M. S. candidate. His research interests include device identification, service identification.
    QIU Jiaxu, born in 2001, M. S. candidate. His research interests include network traffic analysis, malicious traffic detection.
    ZHANG Jiahe, born in 2001, M. S. candidate. His research interests include network traffic analysis, malicious traffic detection.
    LIAO Conghui, born in 1998. Her research interests include network traffic analysis, security identification.
    LIAO Ziyu, born in 2001, M. S. candidate. His research interests include malicious traffic detection.

摘要:

近年来,远程控制木马(RAT)被黑客广泛用于数据窃取、系统入侵、勒索攻击等恶意活动,因具有隐蔽性和持久性,RAT成为网络安全领域的重大威胁。针对传统的RAT检测方法在面对加密流量和协议伪装时存在检测率低且漏报严重的问题,基于流量分析的RAT检测技术因对通信行为的深度洞察能力而逐渐成为网络安全领域的研究热点。通过广泛的文献调研,详细介绍利用流量分析识别RAT的最新研究进展。首先,简要概括RAT通信原理以及检测方法;其次,重点总结目前基于流量分析的RAT检测方法;再次,从实际应用的角度梳理RAT检测的具体应用场景;最后,讨论目前研究过程中面临的问题,并提出未来的发展方向。

关键词: 远程控制木马, 恶意流量检测, 流量分析, 木马检测, 深度学习, 机器学习

Abstract:

In recent years, Remote Access Trojans (RATs) have been widely used by hackers for malicious activities such as data theft, system compromise, and ransomware attacks, and their stealth and persistence make them a major threat in the field of cybersecurity. Since the traditional RAT detection methods have low detection rates and high false negative rates when facing encrypted traffic and protocol obfuscation, RAT detection based on traffic analysis has emerged as a cybersecurity research hotspot due to its deep insight capability into communication behaviors. Through extensive literature research, a detailed introduction to the latest research progress using traffic analysis to identify RATs was given. First, a brief overview of the communication principles and detection methods of RAT was provided. Second, the current RAT detection methods using traffic analysis were summarized as the focus. Third, the specific application scenarios of RAT detection were summarized from a practical application perspective. Finally, the problems in the current research process were discussed, and the future development directions were proposed.

Key words: Remote Access Trojan (RAT), malicious traffic detection, traffic analysis, Trojan detection, deep learning, machine learning

中图分类号: