| Related citation: | Jing Xu,Fei Xu,Xiao-Jun Chen,Jin-Qiao Shi,Cheng Qi.Empirical Evaluation of Information Leakage Detection Using Net-flow Analysis[J].Journal of Harbin Institute Of Technology(New Series),2014,21(6):16-21.DOI:10.11916/j.issn.1005-9113.2014.06.004. |
|
| Author Name | Affiliation | | Jing Xu | Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
Dept.of Computer Science, Beijing University of Technology, Beijing 100124, China | | Fei Xu | Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China | | Xiao-Jun Chen | Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China | | Jin-Qiao Shi | Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China | | Cheng Qi | Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China |
|
| Abstract: |
| Because of the widespread of Trojans, organizations and Internet users become more vulnerable to the threat of information leakage. This paper describes an information leakage detection system (ILDS) to detect sensitive information leakage caused by Trojan. In particular, the principles of the system are based on the analysis of net-flows in four perspectives: heartbeat behavior analysis, DNS abnormal analysis, upload-download ratio and content analysis. Heartbeat behavior analysis and DNS abnormal analysis are used to detect the existence of Trojans while upload-download ratio and content analysis can quickly detect when the information leakage happens. Experiments indicate that the system is reliable and efficient in detecting information leakage. The system can also help to collect and preserve digital evidence when information leakage incident occurs. |
| Key words: information leakage heartbeat behavior Trojan detection digital forensics |
| DOI：10.11916/j.issn.1005-9113.2014.06.004 |
| Clc Number:TP391.7 |
| Fund: |
