《计算机应用》唯一官方网站 ›› 2026, Vol. 46 ›› Issue (10): 3215-3226.DOI: 10.11772/j.issn.1001-9081.2025091099
• 网络空间安全 • 上一篇
张斌1,2, 汪文勇1,3(
), 朱启勋4, 邱家徐1, 张家禾1, 廖聪慧4, 廖梓宇1
收稿日期:2025-09-25
修回日期:2026-01-21
接受日期:2026-02-04
发布日期:2026-04-02
出版日期:2026-10-10
通讯作者:
汪文勇
作者简介:张斌(1989—),男,山西晋中人,高级工程师,博士,主要研究方向:网络流量分析、终端识别、业务识别
Bin ZHANG1,2, Wenyong WANG1,3(
), Qixun ZHU4, Jiaxu QIU1, Jiahe ZHANG1, Conghui LIAO4, Ziyu LIAO1
Received:2025-09-25
Revised:2026-01-21
Accepted:2026-02-04
Online:2026-04-02
Published:2026-10-10
Contact:
Wenyong WANG
About author:ZHANG Bin, born in 1989, Ph. D., senior engineer. His research interests include network traffic analysis, device identification, service identification.摘要:
近年来,远程控制木马(RAT)被黑客广泛用于数据窃取、系统入侵、勒索攻击等恶意活动,因具有隐蔽性和持久性,RAT成为网络安全领域的重大威胁。针对传统的RAT检测方法在面对加密流量和协议伪装时存在检测率低且漏报严重的问题,基于流量分析的RAT检测技术因对通信行为的深度洞察能力而逐渐成为网络安全领域的研究热点。通过广泛的文献调研,详细介绍利用流量分析识别RAT的最新研究进展。首先,简要概括RAT通信原理以及检测方法;其次,重点总结目前基于流量分析的RAT检测方法;再次,从实际应用的角度梳理RAT检测的具体应用场景;最后,讨论目前研究过程中面临的问题,并提出未来的发展方向。
中图分类号:
张斌, 汪文勇, 朱启勋, 邱家徐, 张家禾, 廖聪慧, 廖梓宇. 基于流量分析的远程控制木马检测方法综述[J]. 计算机应用, 2026, 46(10): 3215-3226.
Bin ZHANG, Wenyong WANG, Qixun ZHU, Jiaxu QIU, Jiahe ZHANG, Conghui LIAO, Ziyu LIAO. Survey of remote access Trojan detection methods based on traffic analysis[J]. Journal of Computer Applications, 2026, 46(10): 3215-3226.
| 数据集 | 简介 | 是否包含RAT流量 | RAT种类数 |
|---|---|---|---|
| TON IoT[ | IoT设备行为审计数据集,含恶意操作记录 | 包含IoT-RAT基础行为日志 | 7 |
Malware Capture Facility Project[ | 捷克Stratosphere IPS维护的高价值恶意行为日志库,覆盖超过50个 活跃RAT家族的进程注入、持久化配置及数据窃取等系统级轨迹 | 包含高密度RAT行为日志 | 4 |
Isot App and Botnet Dataset[ | 进程‒DNS关联审计数据集,含僵尸网络驱动的RAT行为, 记录API调用与域名解析的时序交互事件 | 包含RAT隐蔽执行行为日志 | 3 |
表1 文件日志数据集
Tab. 1 File log datasets
| 数据集 | 简介 | 是否包含RAT流量 | RAT种类数 |
|---|---|---|---|
| TON IoT[ | IoT设备行为审计数据集,含恶意操作记录 | 包含IoT-RAT基础行为日志 | 7 |
Malware Capture Facility Project[ | 捷克Stratosphere IPS维护的高价值恶意行为日志库,覆盖超过50个 活跃RAT家族的进程注入、持久化配置及数据窃取等系统级轨迹 | 包含高密度RAT行为日志 | 4 |
Isot App and Botnet Dataset[ | 进程‒DNS关联审计数据集,含僵尸网络驱动的RAT行为, 记录API调用与域名解析的时序交互事件 | 包含RAT隐蔽执行行为日志 | 3 |
| 数据集 | 简介 | 是否包含RAT流量 | RAT种类数 |
|---|---|---|---|
| CTU-13[ | 捷克技术大学发布的僵尸网络流量数据集,包含 RAT流量(如Neris、Rbot、Virut等) | 包含多种远控和僵尸网络流量 | 5 |
| ISCX Botnet Dataset (2014)[ | CIC早期数据集,含多个Botnet和RAT流量 | 包含 | 8 |
| CIC-IDS2017[ | 加拿大网络安全机构发布的大型数据集,含多种攻击流量 (含Backdoor和RAT流量片段),例如ISCX-Bot-2014 | 包含Backdoor(含RAT特征) | 9 |
| CIC-DDoS2019[ | 主要是DDoS流量,但部分数据含恶意远程控制阶段特征 | 少量相关 | 7 |
表2 流量数据集
Tab. 2 Traffic datasets
| 数据集 | 简介 | 是否包含RAT流量 | RAT种类数 |
|---|---|---|---|
| CTU-13[ | 捷克技术大学发布的僵尸网络流量数据集,包含 RAT流量(如Neris、Rbot、Virut等) | 包含多种远控和僵尸网络流量 | 5 |
| ISCX Botnet Dataset (2014)[ | CIC早期数据集,含多个Botnet和RAT流量 | 包含 | 8 |
| CIC-IDS2017[ | 加拿大网络安全机构发布的大型数据集,含多种攻击流量 (含Backdoor和RAT流量片段),例如ISCX-Bot-2014 | 包含Backdoor(含RAT特征) | 9 |
| CIC-DDoS2019[ | 主要是DDoS流量,但部分数据含恶意远程控制阶段特征 | 少量相关 | 7 |
| 模型 | 阶段 | 数据集 | 性能 |
|---|---|---|---|
| 随机森林[ | 早期连接 | 自建数据集(10种RAT,10种正常应用) | Acc: 97.1%, FPR: 2.3%, FNR: 10.0% |
| 随机森林[ | 早期连接 | 自建数据集(35种RAT,12种正常应用) | 已知RAT: Acc: 99.38%, FPR: 0.44%, FNR: 2.90%; 未知RAT: Acc: 98.50%, FPR: 1.53%, FNR: 1.19% |
| 随机森林[ | 早期连接 | 自建数据集(10种RAT,10种正常应用) | Acc: 98.8%, FPR: 0.6%, FNR: 10.0% |
| 随机森林[ | 保持连接,命令与控制 | 8种已知RAT训练和7种未知RAT测试 | Acc: 97.2%, FPR: 3.8% |
| AdaBoost[ | 保持连接,命令与控制 | 20台虚拟机自采数据,5类良性程序和 20种RAT | 已知RAT: TPR 93.6%, FPR 0.4%; 未知RAT: TPR 81.9%, FPR 0.2% |
| 1D-CNN[ | 早期连接 | 自建加密流量数据集 | Acc: 96.8%, Recall: 97.5%, F1: 97.1% |
RATMD(CNN+ 马尔可夫矩阵)[ | 早期连接 | 58良性应用,61种RAT,跨操作系统环境 测试 | Acc: 95.5%, Recall: 95.0%, Precision: 96.1%, F1: 95.4% |
表3 基于不同通信阶段的检测方法的性能对比
Tab. 3 Performance comparison of detection methods based on different communication stages
| 模型 | 阶段 | 数据集 | 性能 |
|---|---|---|---|
| 随机森林[ | 早期连接 | 自建数据集(10种RAT,10种正常应用) | Acc: 97.1%, FPR: 2.3%, FNR: 10.0% |
| 随机森林[ | 早期连接 | 自建数据集(35种RAT,12种正常应用) | 已知RAT: Acc: 99.38%, FPR: 0.44%, FNR: 2.90%; 未知RAT: Acc: 98.50%, FPR: 1.53%, FNR: 1.19% |
| 随机森林[ | 早期连接 | 自建数据集(10种RAT,10种正常应用) | Acc: 98.8%, FPR: 0.6%, FNR: 10.0% |
| 随机森林[ | 保持连接,命令与控制 | 8种已知RAT训练和7种未知RAT测试 | Acc: 97.2%, FPR: 3.8% |
| AdaBoost[ | 保持连接,命令与控制 | 20台虚拟机自采数据,5类良性程序和 20种RAT | 已知RAT: TPR 93.6%, FPR 0.4%; 未知RAT: TPR 81.9%, FPR 0.2% |
| 1D-CNN[ | 早期连接 | 自建加密流量数据集 | Acc: 96.8%, Recall: 97.5%, F1: 97.1% |
RATMD(CNN+ 马尔可夫矩阵)[ | 早期连接 | 58良性应用,61种RAT,跨操作系统环境 测试 | Acc: 95.5%, Recall: 95.0%, Precision: 96.1%, F1: 95.4% |
| 模型 | 数据集 | 性能 |
|---|---|---|
| C4.5决策树[ | 自建数据集:5种正常应用与RAT(灰鸽子2010) | 木马检测准确率:92%,误报率:约2.5% |
| 随机森林[ | 开源RAT和企业正常流量 | Acc:95.7%,AUC:0.979 |
| XGBoost[ | 22种公开RAT10种正常应用流量 | Acc:99.93%,Recall:100%,F1:99.42%,G-Mean:99.42% |
| X-means半监督聚类算法[ | 自建数据集 | Acc:98.3% |
| Transformer[ | CTU(恶意),CIC-IDS2017(正常) | Acc:>90%,F1:>90% |
| LS-CNN/LS-LSTM[ | 自建数据集 | 实现细粒度RAT攻击行为识别 |
| CNN[ | 大型恶意软件样本集 | Acc:88.1%~89.6%,AUC:95.8%~98.5% |
| CNN[ | 公开与自采混合数据集 | Acc:95.5%,Recall:94.2%,F1:94.8% |
表4 基于不同研究对象的检测方法的性能对比
Tab. 4 Performance comparison of detection methods based on different research objects
| 模型 | 数据集 | 性能 |
|---|---|---|
| C4.5决策树[ | 自建数据集:5种正常应用与RAT(灰鸽子2010) | 木马检测准确率:92%,误报率:约2.5% |
| 随机森林[ | 开源RAT和企业正常流量 | Acc:95.7%,AUC:0.979 |
| XGBoost[ | 22种公开RAT10种正常应用流量 | Acc:99.93%,Recall:100%,F1:99.42%,G-Mean:99.42% |
| X-means半监督聚类算法[ | 自建数据集 | Acc:98.3% |
| Transformer[ | CTU(恶意),CIC-IDS2017(正常) | Acc:>90%,F1:>90% |
| LS-CNN/LS-LSTM[ | 自建数据集 | 实现细粒度RAT攻击行为识别 |
| CNN[ | 大型恶意软件样本集 | Acc:88.1%~89.6%,AUC:95.8%~98.5% |
| CNN[ | 公开与自采混合数据集 | Acc:95.5%,Recall:94.2%,F1:94.8% |
| 模型 | 数据集 | 性能 |
|---|---|---|
| 朴素贝叶斯[ | 真实校园网络 | Recall: 100%, FPR: <0.6% |
| CNN-LSTM[ | BTHT-2018 / ISCX-2012 | F1: 99.47% / 93.51% |
| TCN[ | CTU-13 | Acc: 98.78%, Recall: 98.83%, F1: 98.78% |
| 改进序列匹配[ | 5个公开数据集 | F1比最优基线提升21.04% |
表5 基于时间序列的检测方法的性能对比
Tab. 5 Performance comparison of detection methods based on time series
| 模型 | 数据集 | 性能 |
|---|---|---|
| 朴素贝叶斯[ | 真实校园网络 | Recall: 100%, FPR: <0.6% |
| CNN-LSTM[ | BTHT-2018 / ISCX-2012 | F1: 99.47% / 93.51% |
| TCN[ | CTU-13 | Acc: 98.78%, Recall: 98.83%, F1: 98.78% |
| 改进序列匹配[ | 5个公开数据集 | F1比最优基线提升21.04% |
| 方法 | 准确率 | 召回率 | 误报率 | 漏报率 | F1 |
|---|---|---|---|---|---|
| RATMD (CNN)[ | 95.5 | 95.0 | — | — | 95.4 |
| 1D-CNN[ | 96.8 | 97.5 | — | — | 97.1 |
| 随机森林[ | 97.1 | — | 2.3 | 10.0 | — |
| 随机森林[ | 98.8 | — | 0.6 | 10.0 | — |
| 随机森林[ | 99.38 | — | 0.44 | 2.90 | — |
| 随机森林[ | 97.2 | — | 3.8 | — | — |
| 随机森林[ | 95.7 | — | — | — | — |
| AdaBoost[ | 93.6 | — | 0.4 | — | — |
| C4.5决策树[ | 92 | — | 2.5 | — | — |
| XGBoost[ | 99.93 | 100.0 | — | — | 99.42 |
| X-means半监督聚类[ | 98.3 | — | — | — | — |
| Transformer[ | >90 | — | — | — | >90 |
| CNN (MalConv)[ | 88.1~ 89.6 | — | — | — | — |
| 朴素贝叶斯[ | — | 100.0 | <0.6 | — | — |
| CNN-LSTM[ | — | — | — | — | 99.47 |
| TCN[ | 98.78 | 98.83 | — | — | 98.78 |
表6 各类代表性方法的性能指标 (%)
Tab. 6 Performance metrics of various representative methods
| 方法 | 准确率 | 召回率 | 误报率 | 漏报率 | F1 |
|---|---|---|---|---|---|
| RATMD (CNN)[ | 95.5 | 95.0 | — | — | 95.4 |
| 1D-CNN[ | 96.8 | 97.5 | — | — | 97.1 |
| 随机森林[ | 97.1 | — | 2.3 | 10.0 | — |
| 随机森林[ | 98.8 | — | 0.6 | 10.0 | — |
| 随机森林[ | 99.38 | — | 0.44 | 2.90 | — |
| 随机森林[ | 97.2 | — | 3.8 | — | — |
| 随机森林[ | 95.7 | — | — | — | — |
| AdaBoost[ | 93.6 | — | 0.4 | — | — |
| C4.5决策树[ | 92 | — | 2.5 | — | — |
| XGBoost[ | 99.93 | 100.0 | — | — | 99.42 |
| X-means半监督聚类[ | 98.3 | — | — | — | — |
| Transformer[ | >90 | — | — | — | >90 |
| CNN (MalConv)[ | 88.1~ 89.6 | — | — | — | — |
| 朴素贝叶斯[ | — | 100.0 | <0.6 | — | — |
| CNN-LSTM[ | — | — | — | — | 99.47 |
| TCN[ | 98.78 | 98.83 | — | — | 98.78 |
| [1] | Kang J H, Jang S J, Li S Y, et al. Long short-term memory-based malware classification method for information security[J]. Computers and Electrical Engineering, 2019, 77(12): 366-375. |
| [2] | Yang R, Chen X, Xu H, et al. RATScope: recording and reconstructing missing RAT semantic behaviors for forensic analysis on windows[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(3): 1621-1638. |
| [3] | Ferdous J, Islam R, Mahboubi A, et al. A review of state-of-the-art malware attack trends and defense mechanisms[J]. IEEE Access, 2023, 11: 121118-121141. |
| [4] | Jiang W, Wu X, Cui X, et al. A highly efficient remote access Trojan detection method[J]. International Journal of Digital Crime and Forensics, 2019, 11(4): 1-13. |
| [5] | Jiang D, Omote K. An approach to detect remote access Trojan in the early stage of communication[C]// AINA 2015. Piscataway: IEEE, 2015: 706-713. |
| [6] | Valeros V, Garcia S. Growth and commoditization of remote access Trojans[C]// EuroS&PW 2020. Piscataway: IEEE, 2020: 454-462. |
| [7] | Pallaprolu S C, Namayanja J M, Janeja V P, et al. Label propagation in big data to detect remote access Trojans[C]// Big Data 2017. Piscataway: IEEE, 2017: 3539-3547. |
| [8] | Masabo E, Kaawaase K S, Sansa-Otim J. Big data: deep learning for detecting malware[C]// SEiA 2018. Piscataway: IEEE, 2018: 20-26. |
| [9] | Guo C, Song Z, Ping Y, et al. PRATD: a phased remote access Trojan detection method with double-sided features[J]. Electronics, 2020, 9(11): No.1894. |
| [10] | Amouei M, Rezvani M, Fateh M. RAT: reinforcement-learning-driven and adaptive testing for vulnerability discovery in web application firewalls[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(5): 3371-3386. |
| [11] | Yamada M, Morinaga M, Unno Y, et al. RAT-based malicious activities detection on enterprise internal networks[C]// ICITST 2015. Piscataway: IEEE, 2015: 321-325. |
| [12] | El-Metwaly A E S, Abdelfattah M A, Maher N M, et al. Remote Access Trojan (RAT) attack: a stealthy cyber threat posing severe security risks[C]// ITC-Egypt 2024. Piscataway: IEEE, 2024: 1-5. |
| [13] | Adachi D, Omote K. A host-based detection method of remote access Trojan in the early stage[C]// ISPEC 2016, LNCS 10060. Cham: Springer, 2016: 110-121. |
| [14] | Rashid S J, Baker S A, Alsaif O I, et al. Detecting Remote Access Trojan (RAT) attacks based on different LAN analysis methods[J]. Engineering, Technology and Applied Science Research, 2024, 14(5): 17294-17301. |
| [15] | Tran G, Hoang A, Bui T, et al. A deep learning approach to early identification of remote access Trojans[C]// SOICT 2024, CCIS 2351. Singapore: Springer, 2024: 445-456. |
| [16] | 李世淙,云晓春,张永铮. 一种基于分层聚类方法的木马通信行为检测模型[J]. 计算机研究与发展, 2012, 49(S2): 9-16. |
| Li Shicong, Yun Xichun, Zhang Yongzheng. A model of Trojan communication behavior detection based on hierarchical clustering technique[J]. Journal of Computer Research and Development, 2012, 49(S2): 9-16. | |
| [17] | 彭国军,王泰格,邵玉如,等. 基于网络流量特征的未知木马检测技术及其实现[J]. 信息网络安全, 2012(10): 5-9. |
| Peng Guojun, Wang Taige, Shao Yuru, et al. Technology and implementation to detect unknown Trojan based on network flow characteristics[J]. Netinfo Security, 2012(10): 5-9. | |
| [18] | 李巍,李丽辉,李佳,等. 远控型木马通信三阶段流量行为特征分析[J]. 信息网络安全, 2015(5): 10-15. |
| Li Wei, Li Lihui, Li Jia, et al. Characteristics analysis of traffic behavior of remote access Trojan in three communication phases[J]. Netinfo Security, 2015(5): 10-15. | |
| [19] | 朱成. 加密恶意远程访问木马细粒度行为流量识别研究[D]. 南京:东南大学, 2023: 1-83. |
| Zhu Cheng. Research on fine-grained actions traffic identification of encrypted malicious remote access Trojan[D]. Nanjing: Southeast University, 2023: 1-83. | |
| [20] | 王平辉,郑庆华,牛国林,等. 基于流量统计特征的端口扫描检测算法[J]. 通信学报, 2007, 28(12): 14-18. |
| Wang Pinghui, Zheng Qinghua, Niu Guolin, et al. Port scan detection algorithms based on statistical traffic features[J]. Journal on Communications, 2007, 28(12): 14-18. | |
| [21] | Fan Z, Liu R. Investigation of machine learning based network traffic classification[C]// ISWCS 2017. Piscataway: IEEE, 2017: 1-6. |
| [22] | Alshammari R, Zincir-Heywood A N. Investigating two different approaches for encrypted traffic classification[C]// 6th Annual Conference on Privacy, Security and Trust. Piscataway: IEEE, 2008: 156-166. |
| [23] | Alsaedi A, Moustafa N, Tari Z, et al. TON_IoT telemetry dataset: a new generation dataset of IoT and IIoT for data-driven intrusion detection systems[J]. IEEE Access, 2020, 8: 165130-165150. |
| [24] | Paranthaman R, Thuraisingham B. Malware collection and analysis[C]// IRI 2017. Piscataway: IEEE, 2017: 26-31. |
| [25] | Lu C, Liu B, Li Z, et al. An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come?[C]// IMC 2019. New York: ACM, 2019: 22-35. |
| [26] | García S, Grill M, Stiborek J, et al. An empirical comparison of botnet detection methods[J]. Computers and Security, 2014, 45: 100-123. |
| [27] | Habibi Lashkari A, Draper Gil G, Mamun M S I, et al. Characterization of Tor traffic using time based features[C]// ICISSP 3rd — Volume 1. Setúbal: SciTePress, 2017: 253-262. |
| [28] | Sharafaldin I, Lashkari A H, Ghorbani A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]// ICISSP 4th — Volume 1. Setúbal: SciTePress, 2018: 108-116. |
| [29] | Sharafaldin I, Lashkari A H, Hakak S, et al. Developing realistic Distributed Denial of Service (DDoS) attack dataset and taxonomy[C]// ICCST 2019. Piscataway: IEEE, 2019: 1-8. |
| [30] | Bilge L, Dumitraş T. Before we knew it: an empirical study of zero-day attacks in the real world[C]// CCS 2012. New York: ACM, 2012: 833-844. |
| [31] | Başer M, Güven E Y, Aydin M A. Analysis of malicious files gathering via honeypot trap system and benchmark of anti-virus software[J]. Balkan Journal of Electrical and Computer Engineering, 2025, 12(4): 337-348. |
| [32] | Yin K S, Khine M A. Optimal remote access Trojans detection based on network behavior[J]. International Journal of Electrical and Computer Engineering, 2019(3): 2177-2184. |
| [33] | 王晨,郭春,申国伟,等. 利用序列分析的远控木马早期检测方法研究[J]. 计算机科学与探索, 2021, 15(12): 2315-2326. |
| Wang Chen, Guo Chun, Shen Guowei, et al. Research of remote access Trojan early detection method using sequence analysis[J]. Journal of Frontiers of Computer Science and Technology, 2021, 15(12): 2315-2326. | |
| [34] | Yin K S, Khine M A. Network behavioral features for detecting remote access Trojans in the early stage[C]// ICNCC 2017. New York: ACM, 2017: 92-96. |
| [35] | Awad A A, Sayed S G, Salem S A. A network-based framework for RAT-bots detection[C]// IEMCON 2017. Piscataway: IEEE, 2017: 128-133. |
| [36] | Awad A A, Sayed S G, Salem S A. Collaborative framework for early detection of RAT-bots attacks[J]. IEEE Access, 2019, 7: 71780-71790. |
| [37] | Pi B, Guo C, Cui Y, et al. Remote access Trojan traffic early detection method based on Markov matrices and deep learning[J]. Computers and Security, 2024, 137: No.103628. |
| [38] | 雷轩,刘华飞,田峥,等. 面向加密流量的恶意RAT攻击行为识别方法[J]. 信息安全与通信保密, 2024(10): 127-143. |
| Lei Xuan, Liu Huafei, Tian Zheng, et al. Method of identifying malicious RAT attack behavior for encrypted traffic[J]. Information Security and Communications Privacy, 2024(10): 127-143. | |
| [39] | Zhu H, Wu Z, Tian J, et al. A network behavior analysis method to detect reverse remote access Trojan[C]// ICSESS 2018. Piscataway: IEEE, 2018: 1007-1010. |
| [40] | 魏军峰. 行为特征与流量特征相结合的远控木马检测[J]. 网络安全技术与应用, 2022(11): 9-11. |
| Wei Junfeng. Remote Trojan detection based on behavior feature and traffic feature[J]. Network Security Technology and Application, 2022(11): 9-11. | |
| [41] | 吴丰源,刘明,尹小康,等. 基于融合序列的远控木马流量检测模型[J]. 计算机科学, 2024, 51(6): 434-442. |
| Wu Fengyuan, Liu Ming, Yin Xiaokang, et al. Remote access Trojan traffic detection based on fusion sequences[J]. Computer Science, 2024, 51(6): 434-442. | |
| [42] | 邓淼磊,阚雨培,孙川川,等. 基于深度学习的网络入侵检测系统综述[J]. 计算机应用, 2025, 45(2): 453-466. |
| Deng Miaolei, Kan Yupei, Sun Chuanchuan, et al. Summary of network intrusion detection systems based on deep learning[J]. Journal of Computer Applications, 2025, 45(2): 453-466. | |
| [43] | Raff E, Barker J, Sylvester J, et al. Malware detection by eating a whole exe[PP/OL]. arXiv (2017-10-25) [2025-05-14].. |
| [44] | Wu S, Liu S, Lin W, et al. Detecting remote access Trojans through external control at area network borders[C]// ANCS 2017. Piscataway: IEEE, 2017: 131-141. |
| [45] | Jiang X, Li S, Yun X, et al. HSTF-Model: an HTTP-based Trojan detection model via the hierarchical spatio-temporal features of traffics[J]. Computers and Security, 2023, 96: No.101923. |
| [46] | Chen J, Yin S, Cai S, et al. An efficient network intrusion detection model based on temporal convolutional networks[C]// QRS 2021. Piscataway: IEEE, 2021: 768-775. |
| [47] | Li X, Yan H, Lang B, et al. Parallel-SWSA: automated extraction for feature sequences from remote access Trojan attack packets[C]// SMC 2024. Piscataway: IEEE, 2024: 4942-4949. |
| [48] | Zhang Y, Zhuo J, Lin J, et al. MFL-RAT: multi-class few-shot learning method for encrypted RAT traffic detection[C]// Inscrypt 2023, LNCS 14526. Singapore: Springer, 2023: 452-471. |
| [49] | 刘兵,杨娟,汪荣贵,等. 结合记忆与迁移学习的小样本学习[J]. 计算机工程与应用, 2022, 58(19): 242-249. |
| Liu Bing, Yang Juan, Wang Ronggui, et al. Memory-based transfer learning for few-shot learning[J]. Computer Engineering and Applications, 2022, 58(19): 242-249. | |
| [50] | 丁卫球. 基于网络行为特征的木马检测技术[D]. 南京:南京邮电大学, 2013. |
| Ding Weiqiu. A detection technology based on network behavioral characteristics of Trojan[D]. Nanjing: Nanjing University of Posts and Telecommunications, 2013. | |
| [51] | Chen Z, Deng C, Gao X, et al. Malicious cloud service traffic detection based on multi-feature fusion[J]. Electronics, 2025, 14(11): No.2190. |
| [52] | Caballero J, Grier C, Kreibich C, et al. Measuring Pay‑Per‑Install: the commoditization of malware distribution[C]// USENIX Security 2011. Berkeley: USENIX Association, 2011: 1-16. |
| [53] | Panigrahi R, Borah S. A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems[J]. International Journal of Engineering & Technology, 2018, 7(3.24): 479-482. |
| [54] | Draper-Gil G, Lashkari A H, Mamun M S I, et al. Characterization of encrypted and VPN traffic using time-related features[C]// ICISSP 2nd. Setúbal: SciTePress, 2016: 407-414. |
| [55] | Zou Z, Ge J, Zheng H, et al. Encrypted traffic classification with a convolutional long short-term memory neural network[C]// HPCC/SmartCity/DSS 2018. Piscataway: IEEE, 2018: 329-334. |
| [1] | 周益民, 符雯惠, 罗杰, 王娟. 基于时空特征增强网络的端到端抗屏摄攻击鲁棒视频水印[J]. 《计算机应用》唯一官方网站, 2026, 46(9): 2889-2897. |
| [2] | 崔伟, 张平, 肖卓凌, 陈卓航. 基于视觉SLAM的增量式语义建图系统[J]. 《计算机应用》唯一官方网站, 2026, 46(9): 2800-2808. |
| [3] | 刘赏, 汤兆森, 刘鸿月, 董林芳, 周金. 共享语义条件下面向模态缺失的多模态情感分析模型[J]. 《计算机应用》唯一官方网站, 2026, 46(9): 2761-2768. |
| [4] | 刘明, 沈东奇, 孟子洋. 双分支结构下多层次特征融合的点云配准网络[J]. 《计算机应用》唯一官方网站, 2026, 46(8): 2584-2593. |
| [5] | 刘凤春, 邵馨莹, 张春英, 王立亚, 任静. 多尺度特征优化的单目深度估计框架FCMdepth[J]. 《计算机应用》唯一官方网站, 2026, 46(8): 2603-2611. |
| [6] | 刘威, 李维刚, 田志强. 面向点云分类与分割的层次化旋转不变几何结构的表征学习方法[J]. 《计算机应用》唯一官方网站, 2026, 46(8): 2594-2602. |
| [7] | 刘新亮, 徐雨时, 李杜白, 任延昭. 基于知识图谱的问答方法综述[J]. 《计算机应用》唯一官方网站, 2026, 46(8): 2394-2410. |
| [8] | 郭晓金, 隋旭洋, 周柯男. 基于深度学习的STAR⁃RIS辅助混合场通信系统信道估计[J]. 《计算机应用》唯一官方网站, 2026, 46(8): 2548-2554. |
| [9] | 刘晶, 赵邵泽, 刘鑫刚, 牛浩哲, 季海鹏. 跨工况下基于改进CGAN的钛合金显微组织数据生成方法[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2373-2382. |
| [10] | 凌妙根, 井瑞, 方巍. 可解释性深度学习在热带气旋预报中的应用研究综述[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2318-2326. |
| [11] | 杜秀丽, 高星, 张校毓, 潘成胜, 邹启杰. 基于密集时空可变形注意力的视频快照压缩成像重建方法[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2288-2296. |
| [12] | 武湘怡, 叶海良, 曹飞龙. 基于平滑-锐化图卷积的点云补全方法[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2267-2276. |
| [13] | 陈宇, 戚帅康, 许莉薇, 朱浩天. 融合多尺度小波增强与自监督学习的社交机器人检测框架[J]. 《计算机应用》唯一官方网站, 2026, 46(6): 1756-1766. |
| [14] | 杜艺, 续明进, 孔佳仪, 王力瑶, 赵晨. 基于YOLOv11的低秩自适应参数高效微调算法[J]. 《计算机应用》唯一官方网站, 2026, 46(6): 1738-1745. |
| [15] | 熊珍凯, 徐梦军, 孙胤胤, 王鑫. 基于改进YOLOv8的复杂天气环境下海面船舶检测算法[J]. 《计算机应用》唯一官方网站, 2026, 46(6): 1998-2006. |
| 阅读次数 | ||||||
|
全文 |
|
|||||
|
摘要 |
|
|||||