一种基于bot优先抽样的P2P botnet在线检测技术

发布时间：2018-07-11 13:39

本文选题：僵尸网络 + PP　；参考：《解放军理工大学学报(自然科学版)》2013年02期

【摘要】：僵尸网络利用高效灵活的一对多控制机制,为攻击者提供了储备、管理和使用网络攻击能力的基础架构和平台,已成为当前Internet最严重且持续增长的安全威胁之一。为满足在高速网络实时检测P2P僵尸网络的需求,提出了一种基于bot优先抽样的在线检测技术。该方法利用bot优先的分级算法和基于优先级的包抽样算法,使得检测系统能够高效利用计算资源,在整体抽样率有限条件下,优先对疑似P2P僵尸通信数据包进行抽样,并使用流信息重构技术和流簇分析技术对抽样包进行统计分析来发现P2P僵尸主机。实验结果表明,所提出的在线检测技术能够有效提高对疑似P2P僵尸网络流量亚群的包抽样率,具有良好的在线检测效率和P2P僵尸检测命中率。
[Abstract]:Botnet makes use of efficient and flexible one-to-many control mechanism to provide the infrastructure and platform for attackers to reserve, manage and use the network attack ability. Botnet has become one of the most serious and growing security threats in the Internet. In order to meet the need of real-time detection of P2P botnets in high-speed networks, an online detection technique based on bot priority sampling is proposed. This method makes use of the hierarchical algorithm of bot priority and the packet sampling algorithm based on priority, so that the detection system can make efficient use of computing resources. Under the condition of limited overall sampling rate, the proposed method gives priority to sampling suspected P2P zombie communication packets. Stream information reconfiguration and stream cluster analysis are used to analyze the sample packets to find P2P zombie hosts. The experimental results show that the proposed on-line detection technology can effectively improve the packet sampling rate of the suspected P2P botnet traffic subgroup, and has a good on-line detection efficiency and P2P botnet detection hit rate.
【作者单位】：解放军理工大学指挥信息系统学院;北方电子设备研究所;
【基金】：江苏省自然科学基金资助项目(BK2011115)
【分类号】：TP393.08

【相似文献】