论文部分内容阅读
提出了一种基于网络流量相关性和数据融合理论的实时检测P2Pbotnet方法,该方法主要关注P2P botnet的命令与控制机制(C&C)机制产生的本质流量——UDP流,它不会受P2Pbotnet的网络结构、协议和攻击类型的影响.首先分别用自相似性和信息熵来刻画UDP流的相关性特征,利用非参数CUSUM(cumulative sum)算法检测上述特征的变化以得到检测结果,然后利用Dempster-Shafer证据理论融合上述特征的检测结果.同时,采用TCP流量特征在一定程度上消除P2P应用程序对P2Pbotnet检测的影响.实验表明所提出的方法可有效检测新型P2Pbotnet.
A real-time detection P2Pbotnet method based on the network traffic correlation and data fusion theory is proposed. This method focuses on the essential traffic generated by the command and control mechanism (C & C) mechanism of P2P botnet, ie UDP stream, which is not affected by P2Pbotnet’s network Structure, protocol and attack type.Firstly, we use the self-similarity and entropy to characterize the correlation of UDP flows, detect the changes of the above characteristics by non-parametric CUSUM (cumulative sum) algorithm to get the test results, and then use Dempster- Shafer evidence theory combines the detection results of the above features.At the same time, the TCP traffic feature is used to eliminate the influence of P2P application to P2Pbotnet detection to a certain extent.The experiments show that the proposed method can effectively detect the new P2Pbotnet.