Botnet detection system and detection method based on netflow

Abstract

The invention provides a NetFlow based botnet network detection system which comprises a data acquisition module, a pre-processing module, a node evaluation module, a topology discovery module and a correlation analysis module. The node evaluation module obtains suspected botnet network Pboti corresponding to a data stream I through an analytic function Fbot (vi). The correlation analysis module draws and analyzes a data stream communication diagram using the suspected botnet network Pboti as weight and calculates the probability that a target network is a botnet network, and the target network is the botnet network if the probability is larger than a set threshold value. The invention further provides a botnet network detection method. The NetFlow based botnet network detection system and method integrate high-efficiency NetFlow flow analysis, adopt an analysis algorithm, obtain threat coefficients of all nodes and the whole network topology structure and accurately screen botnet networks with complicated network topology, high mobility, high hiding performance and high perniciousness by being combined with specific topology structure of the target network.

Description

technical field [0001] The invention relates to a botnet detection method in the field of computer network security, in particular to a NetFlow-based botnet comprehensive detection system and detection method. Background technique [0002] Computer network is the most important information facility in today's society. With the rapid development of computer network, the problem of network security has gradually attracted people's widespread attention. A botnet (Botnet) refers to a network organized by an attacker (BotOwner) who manufactures and spreads bots to control a large number of nodes (commonly known as zombie machines or bots), using command and control (Command and Control, C&C) channels. It is often used to launch Distributed Denial-of-Service (DDoS) attacks, send spam, spread or host malicious code and phishing websites, or implement attacks such as identity information and business secret theft. [0003] In recent years, botnets have posed a great threat to compu...

AI Technical Summary

Problems solved by technology

[0004] Generally speaking, today's botnets generally have the characteristics of fast update and rapid scale expansion. Some botnets even bypass the detection mechanism by generating a large amount of garbage traffic. Under the circumstances, it is difficult to guarantee accurate and fast

[0005] Existing botnet detection technologies and methods based on network communication monitoring are mostly based on the analysis of the IRC and HTTP protocols commonly used in botnet C&C communication, and the detection of abnormal behaviors such as attacks on botnet infected nodes, which cannot be fast and accurate. botnet detection

Images