摘要： 现有僵尸网络检测方案需要先验知识以获取匹配模式，无法满足实时处理的要求。为此，从分析僵尸网络的特点出发，通过比较僵尸频道消息字符串的相似度，提出基于聚类技术的僵尸网络检测方案。实验结果表明，该方案能有效检测隐藏在正常网络数据流中的僵尸频道。

关键词: 僵尸网络, 命令控制信息, 聚类技术

Abstract: Existing botnet detection schemes require some prior knowledge of botnet to generate matching patterns, and it can not perform detection online. To solve these problems, according to the characteristic of botnet, this paper proposes a botnet detection scheme based on clustering technology by the similarity of botnet channel message strings. Experimental results show that this scheme can detect the bot channels which are hidden in the normal network data flow effectively.

Key words: botnet, command and control information, clustering technology

中图分类号: 

• TP393