In recent years, as the representative of APT attack incidents continues to increase, which steal the confidential information. It's a serious threat to network security and user privacy. The key to prevent such attacks is how to detect Trojan behavior from the network traffic of APT attacks. In this paper, we propose a novel approach based closed-loop feedback model and hierarchical detection model. The result we present improved the detection rate and reduced false positives in detecting Trojan behavior from network traffic. Thus, we can protect user privacy effectively and maintain secure of network environment relatively.