Detection of P2P botnet based on network behavior features and Dezert-Smarandache theory  

基于网络行为特征与Dezert-Smarandache理论的P2P僵尸网络检测（英文）

作　　者：Song Yuanzhang Chen Yuan Wang Junjie Wang Anbang Li Hongyu 宋元章;陈媛;王俊杰;王安邦;李洪雨(中国科学院长春光学精密机械与物理研究所,长春130033)

机构地区：[1]Changchun Institute of Optics,Fine Mechanics and Physics,Chinese Academy of Sciences,Changchun 130033,China

出　　处：《Journal of Southeast University(English Edition)》2018年第2期191-198,共8页东南大学学报（英文版）

基　　金：The National High Technology Research and Development Program of China(863 Program)(No.2011AA7031024G);the National Natural Science Foundation of China(No.61133011,61373053,61472161)

摘　　要：In order to improve the accuracy of detecting the new P2P(peer-to-peer)botnet,a novel P2P botnet detection method based on the network behavior features and Dezert-Smarandache theory is proposed.It focuses on the network behavior features,which are the essential abnormal features of the P2P botnet and do not change with the network topology,the network protocol or the network attack type launched by the P2P botnet.First,the network behavior features are accurately described by the local singularity and the information entropy theory.Then,two detection results are acquired by using the Kalman filter to detect the anomalies of the above two features.Finally,the above two detection results are fused with the Dezert-Smarandache theory to obtain the final detection results.The experimental results demonstrate that the proposed method can effectively detect the new P2P botnet and that it considerably outperforms other methods at a lower degree of false negative rate and false positive rate,and the false negative rate and the false positive rate can reach 0.09 and 0.12,respectively.为提升对新型P2P僵尸的检测精度,提出了一种基于网络行为特征和Dezert-Smarandache理论的P2P僵尸检测方法.该方法主要关注P2P僵尸的本质异常特征,即网络行为特征,该特征不受拓扑结构、协议和攻击类型的影响.首先,利用局部奇异性和信息熵对网络行为特征进行多方面的描述;然后,利用卡尔曼滤波器对网络行为特性进行异常检测;最后,用Dezert-Smarandache理论对上述检测结果进行融合以得到最终检测结果.实验结果表明:所提方法可有效检测新型P2P僵尸;相比其他方法,其漏报率和误报率较低,分别为0.09和0.12.

关 键 词：P2P(peer-to-peer)botnet local singularity ENTROPY Kalman filter Dezert-Smarandache theory 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]