Detecting P2P Botnet by Analyzing Macroscopic Characteristics with Fractal and Information Fusion  

作　　者：SONG Yuanzhang 

机构地区：[1]Changchun Institute of Optics,Fine Mechanics and Physics,Chinese Academy of Sciences

出　　处：《China Communications》2015年第2期107-117,共11页中国通信（英文版）

基　　金：supported by National High Technical Research and Development Program of China(863 Program)under Grant No.2011AA7031024G;National Natural Science Foundation of China under Grant No.90204014

摘　　要：Towards the problems of existing detection methods,a novel real-time detection method(DMFIF) based on fractal and information fusion is proposed.It focuses on the intrinsic macroscopic characteristics of network,which reflect not the "unique" abnormalities of P2P botnets but the "common" abnormalities of them.It regards network traffic as the signal,and synthetically considers the macroscopic characteristics of network under different time scales with the fractal theory,including the self-similarity and the local singularity,which don't vary with the topology structures,the protocols and the attack types of P2P botnet.At first detect traffic abnormalities of the above characteristics with the nonparametric CUSUM algorithm,and achieve the final result by fusing the above detection results with the Dempster-Shafer evidence theory.Moreover,the side effect on detecting P2P botnet which web applications generated is considered.The experiments show that DMFIF can detect P2P botnet with a higher degree of precision.Towards the problems of existing detection methods,a novel real-time detection method（DMFIF） based on fractal and information fusion is proposed.It focuses on the intrinsic macroscopic characteristics of network,which reflect not the ＂unique＂ abnormalities of P2P botnets but the ＂common＂ abnormalities of them.It regards network traffic as the signal,and synthetically considers the macroscopic characteristics of network under different time scales with the fractal theory,including the self-similarity and the local singularity,which don＇t vary with the topology structures,the protocols and the attack types of P2P botnet.At first detect traffic abnormalities of the above characteristics with the nonparametric CUSUM algorithm,and achieve the final result by fusing the above detection results with the Dempster-Shafer evidence theory.Moreover,the side effect on detecting P2P botnet which web applications generated is considered.The experiments show that DMFIF can detect P2P botnet with a higher degree of precision.

关 键 词：P2P botnet fractal information fusion CUSUM algorithm 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP391.41[自动化与计算机技术—计算机科学与技术]