僵尸网络检测技术研究  

Study on the Technology for Detecting the Botnet

作　　者：王钟梅[1] 殷新春[2] 袁秋宇 

机构地区：[1]连云港师范高等专科学校,江苏连云港222006 [2]扬州大学信息工程学院,江苏扬州225009 [3]连云港第七一六研究所,江苏连云港222006

出　　处：《计算机安全》2011年第8期43-46,共4页Network & Computer Security

摘　　要：由于全球网络都在遭受日益广泛的僵尸网络所带来的威胁,因此,必须加大对其防治。僵尸网络检测的方法分为三个部分:"僵尸网络静态特征检测技术"、"僵尸网络动态特征检测技术"、"僵尸网络混合特征检测技术",分别指出了僵尸网络静态特征检测技术的缺陷就是误报率高、僵尸网络动态特征检测技术缺乏先验性和处理数据量大等缺点,最后指出,把这两种方法结合起来,就能够更好地减少数据处理量和提高检测的准确率。As the threat on global network by the botnet becomes more and more widespreading,we must increase the prevention.In this article,there＇re three parts for the methods to test the botnet：botnet detection technology of static features,botnet detection technology of dynamic features,botnet detection technology of mix features,these parts respectively point out that the defect of the static features inspection technology is the high error reports、lack of previous forecast and excessive data processing of the Zombies network detection technology of dynamic features;At last,summarize that the two mechods must be combined which can better reduce the processing data and improve the detection accuracy.

关 键 词：僵尸网络 检测 静态特征 动态特征 混合特征 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]