基于协议分析的IRC僵尸网络检测方法  

A protocol analyse based IRC botnet detection method

作　　者：于洪鹏[1] 刘泽洪[1] 张明辉[1] 

机构地区：[1]哈尔滨金融高等专科学校,哈尔滨150001

出　　处：《微计算机信息》2010年第3期154-155,共2页Control & Automation

摘　　要：IRC协议的利用使僵尸网络趋向智能化,给僵尸网络的检测带来很大难度。通过深入研究IRC僵尸网络运行机制和网络行为交互特征,提出了一种基于IRC协议分析的僵尸网络检测方法——BotDetector,采用流量预处理、IRC协议解析还原、控制命令的模式匹配等关键技术,BotDetector实现了高效、快速的IRC僵尸网络实时检测功能。实验结果表明,BotDetector对于IRC僵尸网络的检测行之有效。The application of IRC protocol makes the detection of botnet difficult. According to studying the mechanism of IRC botnet operating,an IRC botnet detection method based on protocol analysis is proposed （BotDetector for short）. With the technology of traffic preprocess,IRC protocol analysis,and control command pattern match,BotDetector realizes a real-time botnet detection platform. The experiment shows that the method of BotDetector is effective.

关 键 词：协议分析 僵尸网络 IRC协议 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]