僵尸网络关系云模型分析算法

臧天宁; 云晓春; 张永铮; 门朝光

僵尸网络关系云模型分析算法

臧天宁^1,2,3,
云晓春^1,2,3,
张永铮^1,3,
门朝光²

¹中国科学院信息工程研究所,北京市海淀区闵庄路27号100097;²哈尔滨工程大学计算机科学与技术学院,哈尔滨市南通大街145号150001;³信息内容安全技术国家工程实验室,北京市海淀区闵庄路27号100097

基金项目: 国家自然科学基金资助项目(60703021,61070185,60873138);;国家863计划资助项目(2007AA010501)

详细信息

作者简介:
臧天宁，博士，主要研究方向为僵尸网络、协同分析。

中图分类号: P208;TP393
计量
- 文章访问数: 1079
- HTML全文浏览量: 47
- PDF下载量: 520
出版历程
- 收稿日期: 2011-12-14
- 发布日期: 2012-02-04

A Botnet Relationship Analyzer Based on Cloud Model

¹ Institute of Information Engineering,Chinese Academy of Sciences,27 Minzhuang Road,Haidian District, Beijing 100097,China;² College of Computer Science and Technology,Harbin Engineering University,145 Nantong Street,Harbin 150001,China;³ National Engineering Laboratory for Information Security Technologie,27 Minzhuang Road,Haidian District, Beijing 100097,China

Funds: 国家自然科学基金资助项目(60703021,61070185,60873138);;国家863计划资助项目(2007AA010501)

摘要

摘要: 通过分析僵尸网络内部的通信行为,提取了相同僵尸网络的通信特征,利用这些特征定义了僵尸网络之间关系的云模型,并设计了基于云模型的僵尸网络关系分析算法。通过典型僵尸程序样本的评测结果表明,即使对采用加密通信和无固定通信时间间隔的僵尸程序,该算法仍然能够有效地识别出这些僵尸网络之间的关系。通过与相关研究工作的对比表明,该算法在分析的准确度、僵尸网络的类型和加密通信等方面均优于相关研究成果。
- 僵尸网络 /
- 云模型 /
- 迁移 /
- 相似度
Abstract: An approach for analyzing the relationship among botnets was presented.Several botnet communication characteristics were extracted,including the amount of data flows within a botnet,the number of packets per data flow,the payload of communication and data packets in the master hosts.Statistical similarity functions of botnet characteristics were defined.Based on the cloud model and the defined statistical similarity functions,the analysis model of botnet relationship was build,and the similarities of botnet characteristics were synthetically evaluated.The analysis experiments were conducted based on a simulation network environment.The experimental results show that the presented method was valid and efficient,even in the case of encrypted botnet communication messages.The result is better than the research production in the report on the interrelated research achievements.
- botnet /
- cloud model /
- migration /
- similarity

HTML全文

参考文献(0)

施引文献

资源附件(0)

计量

文章访问数: 1079
HTML全文浏览量: 47
PDF下载量: 520
被引次数: 0

僵尸网络关系云模型分析算法

作者简介: 臧天宁，博士，主要研究方向为僵尸网络、协同分析。

计量

出版历程

A Botnet Relationship Analyzer Based on Cloud Model

计量

出版历程

目录

作者简介:
臧天宁，博士，主要研究方向为僵尸网络、协同分析。