Prototype Demonstration: Trojan Detection and Defense System

This paper presents a novel Trojan detection and defense system. The prototype searches the important files which contain users´ confidential information on the disk. And then, these files will be monitored to find which processes will access them by capturing and analyzing the IRPs (I/O request packets). The processes of Trojans will be distinguished from regular ones by evaluating their API-calls with several machine-learning models, rather than traditional signature-based mechanism. Testing results show that this prototype could detect and defend the unknown Trojans quickly and accurately.