Zombie network detection method, device and processor

Abstract

The invention discloses a zombie network detection method, a device and a processor. The method comprises the steps as follows: each node is divided into a plurality of communication clustering groups according to the communication behavior characteristic value of each data stream in an obtained network, wherein nodes in each communication clustering group have similar communication behavior; aggressive clustering is realized on each node, wherein aggressive behavior produced by nodes in each aggressive clustering group is similar; and then a communication clustering result and an aggressive clustering result are compressively analyzed with a cross clustering algorithm, so that zombie nodes belonging to the same zombie network are finally obtained according to the relation between the communication clustering result and the aggressive clustering result, and detection on the zombie network is realized. The method is based on the basic characteristic of the zombie network, and the basic characteristic of the zombie network is constant. The method is independent from the category of the zombie network and has high universality, and the problem that only one type or one kind of the zombie networks can be detected in the prior art is solved.

Description

technical field [0001] The invention relates to the field of information technology, in particular to a botnet detection method, device and processor. Background technique [0002] Botnet refers to the use of one or more transmission methods to infect a large number of hosts with bot program (bot program) viruses, thus forming a one-to-many controllable network between the controller and the infected hosts. Attackers spread bots in various ways to infect a large number of hosts on the Internet, and the infected hosts will receive instructions from attackers through a control channel, thus forming a botnet. At present, work on botnets has started, and there are some detection algorithms that can detect botnets. [0003] The current botnet detection algorithms are mainly honeypot technology and feature-based detection algorithms. Among them, the honeypot technology refers to placing an unpatched honeypot in the network and monitoring its infection. The honeypot can effectiv...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the purpose of the present invention is to provide in order to solve existing botnet detection algorithm, can only detect one or a kind of botnet, when the structure of botnet or communication protocol change, detection algorithm often can't be carried out. For the problem of effective detection, the application discloses a botnet detection method, device and processor, and the specific implementation scheme is as follows:

Images