Method for preventing botnet based on botnet program propagation behaviors

Abstract

The invention discloses a method for preventing a botnet based on botnet program propagation behaviors. The method comprises the steps of establishing a user social network access model and a suspected link clicking model; establishing a botnet propagation defending game model; and establishing a target network user social network structure model. On this basis, the user social network access model and the suspected link clicking model are coupled to the game model, a simulation system of the coupled model is provided, the simulation system operates on the basis of the established target network user social network structure, and then defending measures are provided for a target network. In allusion to a social network based botnet prevention problem, the method disclosed by the invention evaluates approaches which are easy to be intruded or attacked by botnet programs in the target network through establishing the botnet propagation defending game model coupling user behaviors of the target network, and provides defending measures for the target network to prevent propagation and attack of the botnet programs, thereby improving the safety performance of the network.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a botnet prevention method based on bot propagation behavior. Background technique [0002] A botnet is a collaborative computer group that can be remotely controlled by an attacker through a command and control channel. According to the working mechanism of a botnet, the activities of a botnet are mainly divided into three stages: propagation, attack, and command and control. Using botnets, attackers can launch cyber attacks such as distributed denial-of-service attacks, online identity theft, spam, mass distribution of Trojan horses, and spyware. As the most effective general attack platform in the hands of attackers, the number of various botnets is increasing exponentially year by year, and various attack activities are becoming more and more frequent, which has become one of the most serious security threats on the Internet. [0003] At present, defense technologie...

AI Technical Summary

Problems solved by technology

However, the capture technology based on honeypots or honeynets is a wait-and-see detection technology, and it is usually only possible to detect when the intrusion or attack activities of the botnet occur on a large scale

Therefore, the response of this solution to the botnet is seriously lagging behind, and the harm of the botnet intrusion or attack is not evaluated in advance, and effective preventive measures cannot be given, and the initiative and the ability to predict the attack are lacking.

Images