基于P2P僵尸主机网络行为的检测与监控方案设计  

The design of P2P botnet host detection and monitoring based on network behavior

作　　者：樊郁徽[1] 徐宁[1] 

机构地区：[1]淮南师范学院计算机与信息工程系,安徽淮南232038

出　　处：《重庆文理学院学报（社会科学版）》2014年第2期99-103,112,共6页Journal of Chongqing University of Arts and Sciences（Social Sciences Edition)

基　　金：安徽高校省级自然科学基金资助项目(KJ2012Z363)

摘　　要：通过对P2P僵尸主机生存周期的研究,采取离线与在线相结合的方法,分析捕获的网络出口流量,对处于初始阶段、发呆阶段和攻击阶段的P2P僵尸主机的网络行为进行检测和监控,并对确认的内网P2P僵尸主机进行隔离.方案极大提高了P2P僵尸主机检测的效率和正确率,减轻了P2P僵尸网络的危害.Through the research on the life cycle of P2P botnet host, integrated with offline and modes, this paper proposes a new technique to analyze the export network flow which is be captured, detect and monitor the P2P botnet hosts which are on the initial stage, wait make identify P2P botnet hosts live in isolation. The solution can implement hosts more efficiently and precisely, and reduce the harm of the botnet. stage and attack stage the detection for P2P online and to , then botnet

关 键 词：P2P 僵尸网络 生存周期 SMTP 垃圾邮件 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]