Abstract: Traditional detection approach based on fingerprint has a higher rate of false negatives．To this end,this paper put forward a detection approach of Trojans control behavior based on timing analysis of network sessions．Firstly,it calculats the weighted Euclidean distance between clustering dataflow,then the Trojans control behavior can be detected by ti-ming relationships of clustering data．Experiments show that the approach did not need fingerprint database,and can achieve higher correct detection rate,less consumption of resource real-time detection and processing.

Key words: Timing analysis,Clustering,Trojan control,Behavior recognition,Intrusion detection