基于树突细胞算法的P2P僵尸程序检测  

The Detection of P2P Bots Using Dendritic Cells Algorithm

作　　者：丁婷婷[1,2] 王丽[1] 王宝楠[1] 方贤进[1] 

机构地区：[1]安徽现代信息工程职业学院,安徽六安232200 [2]安徽理工大学计算机学院,安徽淮南232001

出　　处：《安徽理工大学学报（自然科学版）》2017年第2期22-27,共6页Journal of Anhui University of Science and Technology:Natural Science

基　　金：国家自然科学基金资助项目(61402012)

摘　　要：随着僵尸网络带来越来越多的网络安全威胁,一种新的使用P2P协议的僵尸程序广泛出现。由于P2P僵尸网络不存在中心控制点而很难对其进行关闭或者追踪,从而使P2P僵尸网络的检测非常困难。为了应对这些威胁,根据免疫系统中的树突细胞的功能,提出了基于树突细胞算法用于检测个体主机中的僵尸程序的模型,并且给出了检测方法。用于检测P2P僵尸程序的原始数据通过APItrace工具获得,进程(包括正常进程和僵尸程序进程)的ID被映射为"抗原",进程所产生的行为数据被映射为"信号",它们组成了检测算法的时间序列输入数据并用于数据融合和相互关联。相关实验表明,文中所提出的方法可以实现P2P僵尸程序的检测。New bots with P2P protocols start to appear with the increasing threat to network security due to the fact that P2P bots net hasn＇ t a centralized point to shutdown or trace back, thus making it very difficult to detect P2P bots. In response to these threats, the model in terms of the functions of the dendritic cells in immune system, called the Dendritic Cells Algorithm （ DCA）, is presented to detect P2P bots on an individual host. The proposed approach to detect P2P bots is also given. The raw data for P2P bot detection is obtained via APITrace tool. The processes ID are mapped into the antigens, and the behavioral data created by the processes are mapped into the signals, which are the time series input data of DCA and used to implement data fusion and correlation. The related experimental results show that the proposed method can be used to detect P2P bots in this paper.

关 键 词：P2P僵尸程序 树突状细胞算法 数据融合与相互关联 异常系数 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]