Botnet detection method, system and storage medium

Abstract

The invention discloses a botnet detection method, system and storage medium. The method comprises: obtaining original network flow data in the monitored network, preprocessing the original network flow data, and obtaining preprocessed network flow data; The preprocessed network traffic data constructs a terminal access relationship graph; from the terminal access relationship graph, a list of terminal identifiers accessing multiple same domain names is mined to obtain a candidate node combination. Based on the preset screening rules, the candidate node combination is screened to obtain Detection results of botnet nodes. The scheme of the present invention has fewer types of applied data, fewer features extracted from data traffic, less computational overhead, and can effectively improve detection efficiency, and the scheme does not need to be detected based on well-known botnet behavior characteristics, and can be better applied detection of unknown botnet threats.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a botnet detection method, system and storage medium. Background technique [0002] Botnet refers to the use of one or more means of propagation to infect a large number of hosts with the bot (BOT program) virus, thereby forming a one-to-many command and control between the controller and the infected host. and Control, C&C) network. The attacker spreads the bot program to infect a large number of hosts on the Internet through various channels, and the infected host accepts the attacker's instructions through a control channel to form a botnet. This attack method provides attackers with a hidden, flexible and efficient one-to-many command and control mechanism, enabling attackers to achieve information theft, distributed denial attacks, and spam sending, and has become an important issue in the current network security field. threaten. [0003] At present, the mainstr...

AI Technical Summary

Problems solved by technology

However, these methods require a variety of data information, huge data streams, and need to analyze data packets to extract multiple features, and the processing load is too large, resulting in low detection efficiency of botnets

Images