A botnet detection method and system based on gateway and local

Abstract

The invention discloses a Botnet detection method and system based on a gateway and a local. Firstly, the host flow monitoring and the gateway flow monitoring are carried out respectively, and the network data packets are captured in real time; the content information and time information of the network data packets are acquired through analysis; the network data packets are judged The content similarity, time similarity or host network behavior between data packets, the above three detection operations are used in combination according to needs, and the weights are set separately to judge whether the total weight reaches the warning value. If so, it is considered that there is a Botnet. And call the police, otherwise it is considered safe. The technical solution provided by the present invention solves the problem of detection lag in signature code scanning and network traffic technology, and does not require cluster construction like honeypot technology, saving resources and time.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a gateway-based and local Botnet detection method and system. Background technique [0002] With the rapid upgrading of software and hardware and the popularization of the Internet, malicious codes have also evolved accordingly, showing a geometric progression in terms of both quantity and type. Among the types of malicious code, there is a large category of Botnet, which is a botnet. Botnet refers to the use of a variety of propagation methods to infect a large number of hosts with bot programs, thereby forming a network that can be controlled one-to-many between the controller and the infected hosts. are at the forefront of malicious code. [0003] Since 1993, Eggdrop, the first Bot tool, has appeared in the IRC chat network, and various Botnet malicious codes such as TFN, TFN2K, Trinoo, GTBot, Sdbot, Agobot, Gaobot, RBot, Spybot, and Phatbot have appeared one af...

AI Technical Summary

Problems solved by technology

Protocol identification is even more difficult to distinguish which are malicious code exploits and which are normal behaviors

Images