RESEARCH OF BOTNET ANOMALY DETECTION ALOGRITHM BASED ON PRIVATE PROTOCOL

摘要：

Since the most domestic popular botnets based on private protocols use encrypted communication, the performance of traditional anomaly detection methods based on DPI technology for botnet is not ideal. This paper, with utilization of the feature that there exists periodic communication behavior in botnet, regards source IP, destination IP and destination port as the unique identifier to extract the time sequence which is analyzed in frequency domain. Because abnormal data has obvious periodicity, the corresponding distribution of frequency is relatively more centralized while normal data decentralized. Based on the spectral characteristics, this paper uses coefficient of variation of spectrum and spectral entropy to realize anomaly detection of botnet. Experimental results show that the detection algorithm based on coefficient of variation of spectrum achieves better results.

关键词： botnet periodic communication variation coefficient

作者: Luying Chen Xinliang Wang Xin Zhao Weimin Li

作者单位: School of Information and Communication EngineeringBeijing University of Posts and Telecommunication School of Information and Communication Engineering Beijing University of Posts and Telecommunicatio

会议类型: 国际会议

会议名称: 2010 3rd IEEE International Conference on Broadband Network & Multimedia Technology(2010年第三届IEEE宽带网络与多媒体国际会议 IC-BNMT 2010)

会议地点: 北京

会议语种:英文

页码: 55-59

在线出版日期: 2010-10-26（万方平台首次上网日期，不代表论文的发表时间）