Method for detecting P2P botnet structure based on network flow clustering

Abstract

The invention discloses a method for detecting a peer-to-peer (P2P) botnet structure based on network flow clustering. In the method, the detection of the P2P botnet structure is finished by the sequential execution of a real-time communication data acquisition module, a datagram record and filter module, a network flow extraction module, a network flow record and filter module, a network flow clustering module and a data association and result display module. The basic thought of the method is that: a defender determines a command and control relationship between P2P botnet nodes in a monitored network so as to give a P2P botnet structure by identifying a command and control communication in the communication data of the monitored network by utilizing the regularity, namely the characteristics such as the duration, the quantity of datagrams, the quantity of bytes and the like, between the command and the control communication between the P2P botnet nodes. The main innovations are that: communication network flows which have similar characteristics are clustered by a clustering method; and compared with the characteristics in a characteristic set of the command and the control communication, normal communication is distinguished from P2P botnet communication, so that the aim of detecting the P2P botnet structure is fulfilled.

Description

technical field [0001] The invention relates to a method for discovering network structure, more particularly, a method for detecting P2P botnet structure based on network flow clustering. Background technique [0002] Botnets are a network composed of a large number of computer programs that control computer resources without authorization and can accept remote control commands to perform corresponding operations. It is a new attack method evolved from the form of traditional malicious code. It provides attackers with a hidden, flexible and efficient one-to-many command and control mechanism, which can control a large number of zombie hosts to achieve information theft and distributed denial of service attacks. and spam sending and other attack purposes; among them, the one-to-many command and control mechanism is its essential feature. An attacker is a computer or person who, by using a computer network, takes actions to disrupt, block, impair or destroy information resid...

AI Technical Summary

Problems solved by technology

Compared with centralized botnets, P2P botnets are not easily detected and have stronger concealment

Images