检测僵尸网络的贝叶斯算法的MapReduce并行化实现  

The parallel implementation of MapReduce for the Bayesian algorithm to detect botnets

作　　者：邵秀丽[1] 刘一伟[2] 耿梅洁 韩健斌 

机构地区：[1]南开大学计算机与控制工程学院,天津300071 [2]北京大学数学科学学院,北京100871 [3]武警指挥学院军事教育训练系,天津300250

出　　处：《智能系统学报》2014年第1期26-33,共8页CAAI Transactions on Intelligent Systems

基　　金：天津市科技支撑计划资助项目(13ZCZDZGX02500;12ZCZDZGX49600;12ZCZDZGX46700)

摘　　要：僵尸网络严重威胁互联网的安全,目前主流的僵尸网络检测方法准确性较低,针对此问题,考虑贝叶斯算法具有较高的准确性,提出了基于Hadoop平台的MapReduce机制的贝叶斯算法。该方法以主机对作为分析对象,提取2个主机对通信的流量特征,将这些特征作为贝叶斯分类算法的输入,通过并行化计算贝叶斯算法训练阶段的先验概率和条件概率形成贝叶斯分类器,使其学会辨认僵尸网络的流量。在检测阶段利用训练阶段形成的贝叶斯分类器和并行化计算后验概率,实现检测僵尸网络。通过实验表明,该方法检测僵尸网络是有效的,检测正确率在90%以上,并且该方法较单机检测僵尸网络的贝叶斯算法效率有了较大的提高。The botnet network poses a serious threat to the Internet security , and the accuracy of the botnet detec-tion method is low , while the Bayesian algorithm has high accuracy .This paper puts forward a Bayesian algorithm with the mechanism of MapReduce based on the Hadoop platform to achieve botnet detection .Taking the host-pairs as analysis objects, this method extracts the traffic features of communications between two hosts , takes these fea-tures as input and trains the Bayesian classifier through parallel calculations of the prior probability and condition probability on the stage of the Bayesian algorithm training to learn to recognize botnet traffic .By using the Bayesian classifier trained on the stage of the Bayesian algorithm training and parallel calculations of the posterior probability on the stage of detecting , the detection of botnets can be achieved .Experiments show that the method for detecting botnets is effective and the correct detection rate is more than 90%.The efficiency of this method is greatly im-proved as compared with detecting the single Bayesian algorithm of the botnets .

关 键 词：僵尸网络 检测僵尸网络 贝叶斯算法 流量 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]