通过对Lcass这一恶意程序的监测,作者发现其具有开启后门、感染U盘传播的特点。为验证Lcass是否具备主动发送信息和利用浏览器远程控制的功能,本文搭建了攻击演示平台,并采用Snort入侵检测系统构建了3种入侵检测方案,成功实现对木马程序攻击过程各阶段的检测和报警。最后,针对该木马提出针对性的安全保密防护策略。 By monitoring Lcass this malicious program, the authors found that it has the characteristics of opening the back door, infected U disk spread. In order to verify whether Lcass has the function of sending messages and using the remote control of the browser, this paper builds an attack demo platform and uses Snort intrusion detection system to build three kinds of intrusion detection schemes, which successfully detects and verifies all stages of the Trojan program attack process Call the police. Finally, the Trojan proposed a targeted security strategy.