Method of botnet network nodes detection base on communication similarity

Yuquan JIN; Bin XIE; Yi ZHU

doi:10.11959/j.issn.2096-109x.2018078

您当前的位置：

首页 >

文章列表页 >

Method of botnet network nodes detection base on communication similarity

Papers | 更新时间：2024-06-03

- Method of botnet network nodes detection base on communication similarity
- Chinese Journal of Network and Information Security Vol. 4, Issue 10, Pages: 31-38(2018)
- 作者机构：
  
  1. 中国工程物理研究院电子工程研究所，四川绵阳 621900
  2. 四川大学，四川成都 610065
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018078
  CLC： TP393
- Online First：2018-10，
  
  Published：15 October 2018
- 稿件说明：
移动端阅览
Yuquan JIN, Bin XIE, Yi ZHU. Method of botnet network nodes detection base on communication similarity[J]. Chinese Journal of Network and Information Security, 2018, 4(10): 31-38.
DOI：

Yuquan JIN, Bin XIE, Yi ZHU. Method of botnet network nodes detection base on communication similarity[J]. Chinese Journal of Network and Information Security, 2018, 4(10): 31-38. DOI： 10.11959/j.issn.2096-109x.2018078.

摘要

目前，僵尸网络检测方法大多依靠对僵尸网络通信活动或通信内容的分析，前者对数据流的特征进行统计分析，不涉及数据流中的内容，在检测加密类型方面具有较强优势，但准确性较低；后者依赖先验知识进行检测，具有较强的准确度，但检测的通用性较低。因此，根据杰卡德相似度系数定义了通信相似度，并提出了一种基于用户请求域名系统（DNS，domain name system）的通信相似度计算方法，用于基于网络流量的僵尸网络节点检测。最后，基于Spark框架对所提出的方法进行了实验验证，实验结果表明该方法可以有效地用于僵尸网络节点检测。

Abstract

At present

the botnet detection method mostly relies on the analysis of the network communication activity or the communication content.The former carries on the statistical analysis to the characteristic of the data flow

does not involve the content in the data flow

has the strong superiority in the detection encryption type aspect

but the accuracy is low.The latter relies on the prior knowledge to examine

has the strong accuracy

but the generality of detection is low.The communication similarity was defined according to Jaccard similarity coefficient

and a method of calculating communication similarity based on user request DNS (domain name system) was proposed

which was used for botnet node detection based on network traffic.Finally

based on the spark framework

the experimental results show that the proposed method can be used in the detection of botnet nodes effectively.

关键词

Keywords

references

FALLIERE N , CHIEN E . Zeus:king of the bots,2009 [EB/OL ] . http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/zeus_king_of_bots.pdf http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/zeus_king_of_bots.pdf . 2014 : 07 - 30 .

方滨兴 , 崔翔 , 王威 . 僵尸网络综述 [J ] . 计算机研究与发展 , 2011 , 48 ( 8 ): 1315 - 1331 .

FANG B X , CUI X , WANG W . Survey of botnets [J ] . Journal of Computer Research and Development , 2011 , 48 ( 8 ): 1315 - 1331 .

诸葛建伟 , 韩心慧 , 周勇林 , 等 . 僵尸网络研究 [J ] . 软件学报 , 2008 , 19 ( 3 ): 702 - 715 .

ZHUGE J W , HAN X H , ZHOU Y L , et al . Research and Development of Botnets [J ] . Journal of Software , 2008 , 19 ( 3 ): 702 - 715

HOQUE N , BHATTACHaryya D K , KALITA J K . Botnet in DDoS attacks:trends and challenges [J ] . IEEE Communications Surveys ＆Tutorials , 2015 , 17 ( 4 ): 2242 - 2270 .

IRC Eggdrop:open source bot [EB/OL ] . http://www.eggheads.org/ http://www.eggheads.org/ , 1993 .

李可 . 基于行为分析的僵尸网络对抗技术研究 [D ] . 北京邮电大学 , 2017 .

LI K . Research on botnet countermeasure technology based on behavior analusis [D ] . Beijing University of Posts and Telecommunications , 2017 .

ZEIDANLOO H R , MANAF A B A . Botnet detection by monitoring similar communication patterns [J ] . International Journal of Computer Science ＆ Information Security , 2010 , 7 ( 3 ): 88 - 96 .

GU G , ZHANG J , LEE W . BotSniffer:detecting botnet command and control channels in network traffic [J ] . Computer Science and Engineering , 2008 .

邓国强 . Spamming botnet网络行为分析及检测算法设计与实现 [D ] . 华中科技大学 , 2013 .

DENG G Q . Network behavior analysis of the spamming botnet and the design and implementation of spamming botnet detection algorithms [D ] . Huazhong University of Science and Technology , 2013 .

NARANG P , RAY S , HOTA C , et al . PeerShark:detecting peer-to-peer botnets by tracking conversations [J ] . Medical ＆ Biological Engineering ＆ Computing , 2014 , 51 ( 10 ): 1105 - 1119 .

张维维 , 龚俭 , 刘尚东 , 等 . 面向主干网的DNS流量监测 [J ] . 软件学报 , 2017 , 28 ( 9 ): 2370 - 2387 .

ZHANG W W , GONG J , LIU S D , et al . DNS surveillance on backbone [J ] . Journal of Software , 2017 , 28 ( 9 ): 2370 - 2387

嵇威华 , 吕国芳 . 基于广义 Jaccard 系数处理冲突证据方法 [J ] . 控制工程 , 2015 ( 1 ): 98 - 101 .

JI W H , LV G F . Conflicting evidence combination method based on generalized Jaccard coefficient [J ] . Control Engineering of China , 2015 ( 1 ): 98 - 101

王煜骢 , 陈兴蜀 , 罗永刚 , 等 . NTCI-Flow:一种可扩展的高速网络流量处理框架 [J ] . 四川大学学报(工程科学版) , 2017 ( s1 ): 168 - 174 .

WANGY C , CHEN X S , LUOY G , et al . NTCI-Flow:a scalable high-speed network traffic processing framework [J ] . Journal Sichuan University (Adanced Engineering Sciences) , 2017 ( 1 ): 168 - 174 .

Views

2106

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Security scheme for time-critical TRDP message

Secure multidimensional interconnection network for the software defined system on wafer

Overview on industrial Internet honeynet technology

Efficient and safe software defined network topology discovery protocol

Metric-based learning approach to botnet detection with small samples

Related Author

LU Xiang

CHENG Youlin

WU Xuechao

CUI Yulong

MEI Bo

CAO Zhipeng

GUO Wei

SHEN Jianliang

Related Institution

School of Cyber Security, University of CAS

Institute of Information Engineering, CAS

CRRC Qingdao Sifang Co., Ltd.

Information Engineering University

Engineering Research Center of Smart Energy, Civil Aviation Administration of China

⁰