Abstract: With extensive botnet arising as one of the major current network security threats,the automatic detection of botnet communication traffic is of high importance for Internet service providers and large corporation network monitoring.To solve the problem,this paper proposes a novel approach for botnet detection,a real-time botnet detection algorithm,where netflow related data is correlated as the host netflow graph structure and the host access chain structure,and a feature extraction method is leveraged for exacting implicit characteristics.Meanwhile,this paper establishes BotScanner detection system,which is a real-time steam processing engine.It trains BotScanner system on the four representative bot families and evaluates BotScanner on simulated network traffic and real-world network traffic.Experimental results show that BotScanner is able to detect bots in network traffic without the need of deep packet inspection,while still achieving high detection rates with very few false positives.When the netflow data from the core switch is very large,BotScanner is able to detect botnet in real-time by the efficient algorithm.It proves the feasibility of applying BotScanner system to botnet detection.

Key words: abnormity detection, botnet, netflow, real-time detection, malicious code

摘要： 大规模僵尸网络已成为当前互联网的主要威胁之一,僵尸网络流量自动检测技术对于互联网服务提供商和大型企业网监控非常重要。为此,提出一种基于网络流量异常的僵尸网络实时检测算法,通过将网络流量组织成主机网络流量图谱和主机关系链,并提取内在命令 与控制通信特征检测僵尸网络,同时实现BotScanner检测系统。使用4个主流的僵尸恶意代码家族训练BotScanner,采用模拟网络流量和真实网络流量数据集进行测试。实验结果表明,在无需深度包解析的情况下,BotScanner僵尸网络检测系统能够获得较高的平均检测率和较 低的误报率。在数据量较大的交换机上,BotScanner能够有效地进行实时检测,验证了提出算法用于僵尸网络检测方面的可行性。

关键词: 异常检测, 僵尸网络, 网络流量, 实时检测, 恶意代码

CLC Number: 

• TP309