僵尸网络的检测与防范策略  

Detecting and Defendable Policy of Botnet

作　　者：李晓芸[1] 吴德钢[2] 

机构地区：[1]四川大学信息安全研究所 [2]中国人民解放军73111部队

出　　处：《软件导刊》2008年第10期195-197,共3页Software Guide

摘　　要：僵尸网络是各种恶意软件传播和控制的主要来源,检测僵尸网络对于网络安全非常重要。介绍了僵尸网络的概念、类型以及危害,论述基于IRC协议以及P2P控制方式的检测方法,提出了防范措施。The Botnet is a one-to-many control network which is composed of controller and infected hosts, and the attacker uses one or more broadcasting methods to make a lot of hosts infected.h is primarily coming from various malicious softwares that were casted and controled, and is very important for network security to detect botnet. In this paper, the concept, types and threat of it were introduced, then detecting method was described,based on the controling mode through IRC and P2P protocol, finnally the measure was given to avoid it.

关 键 词：僵尸网络 IRC协议 P2P协议 检测 防范措施 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]