目前互联网上利用木马控制进行网络窃密的行为越来越多,木马网络行为表现与普通网络应用也越来越相似,因而对此类网络可疑行为的检测有着重要的意义。本文从协议深度分析的角度提出基于协议规范分析、协议语义分析、协议伪装分析、协议流量分析4种网络可疑行为检测技术。 At present, the use of Trojans to control network theft on the Internet more and more behavior, Trojans and ordinary network behavior more and more similar applications, and thus the detection of such network suspicious behavior is of great significance. This paper presents four kinds of network suspicious behavior detection techniques based on protocol specification analysis, protocol semantic analysis, protocol disguise analysis and protocol traffic analysis from the perspective of protocol depth analysis.