基于数据流的P2P僵尸网络检测方法  

P2P Botnet Detection Method Based on Data Flow

作　　者：王佳佳[1] WANG Jia-jia(School of Electron and Information Technology, Taizhou Polytechnic College, Taizhou 225300, Chin)

机构地区：[1]泰州职业技术学院信息技术学院,江苏泰州225300

出　　处：《南通职业大学学报》2017年第2期82-86,共5页Journal of Nantong Vocational University

摘　　要：提出了一种基于数据流的P2P僵尸网络检测方法:通过粗粒度检测技术准确提取P2P数据流后,从中检测出P2P僵尸数据流,再根据僵尸数据流特点,采用细粒度检测技术识别出僵尸主机的存在,在攻击发生之前过滤非法数据。实验证明,该方法具有较好的检测效率,其较小的计算复杂度不影响网络的正常工作,可较好地维护网络的安全性。This paper presents a method of P2P botnet detection based on data flow. First of all, extract the P2P data stream accurately, and then detect the P2P bots data stream, the small computational complexity does not affect the normal operation of the network. According to the characteristics of the P2P bots data stream, the existence of the bots can be detected before the attack starts and the illegal data could be filtered out. The experiment results show that this method has good detection efficiency and maintains well the securi- ty of the network.

关 键 词：P2P 僵尸网络 数据流 粗粒度检测 细粒度检测 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]