作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2011, Vol. 37 ›› Issue (7): 166-167,170. doi: 10.3969/j.issn.1000-3428.2011.07.055

• 安全技术 • 上一篇    下一篇

基于聚类技术的僵尸网络检测方案

吕新荣,陆世伟   

  1. (浙江工商职业技术学院计算机应用研究所,浙江 宁波 315012)
  • 出版日期:2011-04-05 发布日期:2011-03-31
  • 作者简介:吕新荣(1976-),男,讲师,主研方向:网络安全,数据挖掘;陆世伟,讲师
  • 基金资助:
    宁波市自然科学基金资助项目(2006A610012);浙江省教育厅科研基金资助项目(Y201017075);浙江省高校优秀青年教师资助计划基金资助项目

Botnet Detection Scheme Based on Clustering Technology

LV Xin-rong, LU Shi-wei   

  1. (Computer Application Research Institute, Zhejiang Business Technology Institute, Ningbo 315012, China)
  • Online:2011-04-05 Published:2011-03-31

摘要: 现有僵尸网络检测方案需要先验知识以获取匹配模式,无法满足实时处理的要求。为此,从分析僵尸网络的特点出发,通过比较僵尸频道消息字符串的相似度,提出基于聚类技术的僵尸网络检测方案。实验结果表明,该方案能有效检测隐藏在正常网络数据流中的僵尸频道。

关键词: 僵尸网络, 命令控制信息, 聚类技术

Abstract: Existing botnet detection schemes require some prior knowledge of botnet to generate matching patterns, and it can not perform detection online. To solve these problems, according to the characteristic of botnet, this paper proposes a botnet detection scheme based on clustering technology by the similarity of botnet channel message strings. Experimental results show that this scheme can detect the bot channels which are hidden in the normal network data flow effectively.

Key words: botnet, command and control information, clustering technology

中图分类号: