Method for detecting botnet based on similarity measurement of host flow power spectrum

Abstract

The invention discloses a method for detecting a botnet based on similarity measurement of host flow power spectrum, and belongs to the field of network communication security. After pretreatment of acquired network output flow data, the network output flow data is described by using an autocorrelation function, and through DFT of the autocorrelation function, flow power spectrum sequences of each of the hosts are obtained. Optimized DTW distances of the hosts on power spectrum sequences are calculated, and the host pairs with the optimized DTW distances which are lower than a threshold are put in a host pair assembly. Finally, reliability of each host pair's state in the host pair assembly is calculated using a space-time association algorithm and whether the botnet exists in the detected network is determined according to the reliability value, thereby realizing detection of the botnet. Using the optimized DTW distances to describe the similarity of the flow power spectrum of the host pairs, influences on detection effect brought about by zombie host individual differences are prevented. Using the space-time association algorithm to analyze the reliability of the host pairs' state makes the best of dependence of host flow in time and space, and detection effect is improved.

Description

technical field [0001] The invention relates to the field of network communication security, in particular to a botnet detection method based on the similarity measurement of the power spectrum of host traffic. Background technique [0002] A botnet refers to a network composed of a one-to-many command and control channel (Command and Control, C&C) by an attacker spreading a bot program to control a large number of hosts for malicious purposes. Botnets provide attackers with a hidden, flexible and efficient one-to-many command and control mechanism. Botnet controllers can control a large number of zombie hosts to achieve information theft, distributed denial of service attacks, and spam sending. Botnets are entering a period of rapid development, posing a serious threat to Internet security. [0003] Representative detection strategies for botnets at home and abroad mainly include detection based on honeypot technology, detection based on terminal information and detection ...

AI Technical Summary

Problems solved by technology

The purpose of this method is to identify homologous botnets that use different IRC control servers. It is only suitable for IRC-type botnets, and it is less effective for new P2P botnets.

Images