基于行为与域名查询关联的僵尸网络聚类联动监测  

Linkage monitoring of cluster for botnet based on relevance of behavior and domain inquiry

作　　者：袁春阳 李青山[2] 王永建 

机构地区：[1]国家计算机网络应急技术处理协调中心,北京100087 [2]北京大学网络与软件安全保障教育部重点室,北京100087

出　　处：《计算机应用研究》2012年第3期1084-1087,共4页Application Research of Computers

基　　金：国家"242"信息安全计划项目(2010A009)

摘　　要：为了解决基于特征的监测只能监测到已知的botnet,且监测方法很大程度依赖于botnet所采用的协议和结构的问题,提出基于行为与域名查询关联的botnet监测方法。利用相同僵尸网络中的各个僵尸活动相互之间具有时间、空间的行为相关性和相似性特点,对botnet的行为流和域名查询流进行聚类,给出一种聚类联动的监测模型。通过采集、分析部署在某市营运机房DNS缓存服务器上的实验系统反馈数据,证明该聚类联动监测模型不仅能够监测未知botnet,而且监测过程与botnet采用的协议结构无关,具有较好的监测效率。Feature：based monitoring can only monitor known botnet, and monitoring methods depend heavily on the structure and the protocol of botnet used. This paper proposed botnet monitoring methods based on behavior associated with the domain name query to solve the problems. It clustered the behavior and domain name query flow of botnet utilizing related and similar characteristics exist in activities among the various bots on time and space. Proposed a linkage monitoring model on clustering. Through the collection and analysis the feedback data of DNS cache server on the test system deployed operating room in the city, it is proved that the linkage monitoring model on clustering can not only monitor the unknown botnet, but also monitoring process independent of the protocol and structure used. It has a good monitoring efficiency.

关 键 词：行为关联 域名分析 僵尸网络 聚类 联动监测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]