基于排列熵和聚类方差的僵尸网络检测方法  

The Botnet Detection Method Based on Permutation Entropy and Clustering Variance

作　　者：王佳佳[1] 罗亚丽 张文伟 周渊 WANG Jia-jia;LUO Ya-li;ZHANG Wen-wei;ZHOU Yuan(School of Information Technology,Taizhou Polytechnic College,Taizhou 225300,Chin)

机构地区：[1]泰州职业技术学院信息技术学院,江苏泰州225300

出　　处：《南通职业大学学报》2018年第2期75-79,共5页Journal of Nantong Vocational University

基　　金：2017年院级大学生创新创业训练计划项目(YJDC2017018)

摘　　要：提出了一种基于多维排列熵和聚类方差的僵尸网络检测方法:根据僵尸主机在传播阶段的通信流量特点,采用多维排列熵计算网络流量时间序列的复杂性,再用聚类方差检测排列熵模型的自相似程度,进而判断网络中的异常。实验证明,该方法可检测出已知和未知的僵尸网络,具有较高的检测率。This paper proposes a botnet detection method based on multidimensional permutation entropy and clustering variance. According to the traffic characteristics in the propagation period of bots, multidimensional permutation entropy is used to calculate the complexity of time series of network traffic. Then cluster variance is used to detect the self-similarity of permutation entropy model so that the abnormal situation of the network can be detected. The experiment shows that this method can detect all the known and unknown botnets with relatively high detective rate.

关 键 词：排列熵 聚类方差 僵尸网络 检则方法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]