基于统计特征的隐匿P2P主机实时检测系统  

Real-time detection system for stealthy P2P hosts based on statistical features

作　　者：田朔玮 杨岳湘[1] 何杰[1] 王晓磊[1] 江志雄[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《计算机应用》2015年第7期1892-1896,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61170286)

摘　　要：针对当前隐匿恶意程序多转为使用分布式架构来应对检测和反制的问题,为快速精确地检测出处于隐匿阶段的对等网络(P2P)僵尸主机,最大限度地降低其危害,提出了一种基于统计特征的隐匿P2P主机实时检测系统。首先,基于3个P2P主机统计特征采用机器学习方法检测出监控网络内的所有P2P主机;然后,再基于两个P2P僵尸主机统计特征,进一步检测出P2P僵尸主机。实验结果证明,所提系统能在5 min内检测出监控网内所有隐匿的P2P僵尸主机,准确率高达到99.7%,而误报率仅为0.3%。相比现有检测方法,所提系统检测所需统计特征少,且时间窗口较小,具备实时检测的能力。Since most malwares are designed using decentralized architecture to resist detection and countering, in order to fast and accurately detect Peer-to-Peer （P2P） bots at the stealthy stage and minimize their destructiveness, a real-time detection system for stealthy P2P bots based on statistical features was proposed. Firstly, all the P2P hosts inside a monitored network were detected using means of machine learning algorithm based on three P2P statistical features. Secondly, P2P bots were discriminated based on two P2P bots statistical features. The experimental results show that the proposed system is able to detect stealthy P2P bots with an accuracy of 99.7% and a false alarm rate below 0.3% within 5 minutes. Compared to the existing detection methods, this system requires less statistical characteristics and smaller time window, and has the ability of real-time detection.

关 键 词：对等网络 僵尸网络 统计特征 机器学习 检测系统 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]