基于报文大小的P2P僵尸网络检测方法  

P2P botnet detection method based on message size

作　　者：谷海红 何杰[3,4] 王浩[4] GU Haihong;HE Jie;WANG Hao(Hebi Institute of Engineering and Technology,Henan Polytechnic University,Hebi 458030,China;Hebi Polytechnic,Hebi 458030,China;College of Computer,National University of Defense Technology,Changsha 410073,China;Department of Information and Communication,Officers College of PAP,Chengdu 610213,China)

机构地区：[1]河南理工大学鹤壁工程技术学院,河南鹤壁458030 [2]鹤壁职业技术学院,河南鹤壁458030 [3]国防科技大学计算机学院,湖南长沙410073 [4]武警警官学院信息通信系,四川成都610213

出　　处：《现代电子技术》2019年第22期98-102,共5页Modern Electronics Technique

基　　金：国家自然科学基金资助项目(61170286)~~

摘　　要：作为当今互联网面临的最为严重的安全威胁之一,僵尸网络已从传统的集中式结构演化至更难检测的P2P分布式结构。对P2P僵尸网络实施有效检测是当前网络安全领域的研究热点之一。文中提出一个基于报文大小的P2P僵尸网络检测方法。该方法仅依靠网络报文大小这一统计值即可实现对处于潜伏阶段的P2P僵尸网络的检测,也可对未知类型的P2P僵尸网络实施检测。在大量真实数据集上的实验结果表明,该检测方法可达到较高的准确率,同时仅有较低的误报率。As one of the most serious security threats to Internet nowadays,the botnet has evolved their structure from tra ditional centralized structure to P2P distributed structure,which makes them more difficult to be detected.The effective detec tion of P2P botnet is one of the research hotspots in the field of network security.A P2P botnet detection method based on mes sage size is proposed,which can be used to realize the detection of P2P botnet in the latent stage only by relying on the statisti cal value of network message size,and detect the unknown type of P2P botnet.The experiment was carried out with a large num ber of real datasets.The results show that the detection method can achieve higher accuracy and lower false rate than those of others。

关 键 词：网络检测 僵尸网络 P2P结构 报文大小 性能验证 结果分析 

分 类 号：TN911[电子电信—通信与信息系统] 34[电子电信—信息与通信工程] TP393[自动化与计算机技术—计算机应用技术]