A p2p botnet detection method, device and medium

Abstract

The embodiment of the present invention discloses a P2P botnet detection method, device and medium to obtain normal network traffic data in a normal network environment and abnormal network traffic data in a P2P botnet network environment; divide the network traffic data into different types of data packets, Calculate the network complexity characteristics of various data packets; use each network complexity characteristics and the corresponding P2P botnet outbreak results as sample data, train the initial probability neural network, and obtain a probability neural network that meets the accuracy requirements. The probabilistic neural network is used to process the network traffic data to be detected, and the P2P botnet outbreak result is obtained. By dividing network traffic data in detail according to packet type, we can more fully mine the correlation between network traffic data and P2P botnet outbreaks, thereby improving the accuracy of probabilistic neural network detection of P2P botnet outbreaks.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a P2P botnet detection method, device and medium based on network complexity features and probabilistic neural networks. Background technique [0002] A botnet (botnet) is a malicious host group. Attackers can use secondary injection to change the load of bot nodes, so as to quickly and easily change the type of attack to be sent, such as distributed denial of service attacks, phishing and Spam attacks, etc. The current new P2P botnet uses the decentralized structure of the P2P network to build its command and control mechanism. Because the structure does not have a control center, it effectively avoids single point failure and is more robust and reliable. [0003] Currently, the research on P2P botnet analysis and detection is in the rising stage. Most detection methods mainly start with some specific and detailed features of P2P botnets, and do not conduct enough in...

AI Technical Summary

Problems solved by technology

When a new type of P2P botnet appears, and the network structure, protocol, and attack type of the botnet are different from the existing P2P botnet, it will lead to a large false negative rate in P2P botnet detection

Images