P2P bot sensing based adaptive network flow sampling method

Abstract

The invention discloses a P2P bot sensing based adaptive network flow sampling method, and belongs to the field of network data processing. The P2P bot sensing based adaptive network flow sampling method comprises the steps of firstly extracting IP addresses of potential P2P bots in a high speed network at a relatively low cost based on essential features of a P2P botnet; then allocating a target sampling rate based on an instant sampling rate allocation algorithm and calculating an instant sampling rate of each IP address; and finally sampling a message by using the instant sampling rates obtained through calculation, inputting the sampled network flows to a P2P botnet detecting system so as to facilitate further fine-grained detection. The P2P bot sensing based adaptive network flow sampling method is fast in adaptive adjustment speed and strong in capability of sensing the P2P bots, can greatly improve the sampling rate of the P2P dot flows extremely under the condition of keeping the target sampling rate unchanged, and can be seamlessly integrated with an existing network flow based P2P dotnet detecting system.

Description

technical field [0001] The invention relates to the field of network data processing, in particular to an adaptive network flow sampling method based on the perception of P2P zombie nodes. Background technique [0002] P2P botnets have become one of the biggest security threats facing the Internet today. Compared with traditional centralized botnets based on IRC or HTTP, P2P botnets are more stealthy and harder to detect. A P2P botnet is a P2P network composed of infected hosts (bots), which are remotely controlled by an attacker (botmaster) through a command and control (C&C) channel. Attackers can use this platform to launch Distributed Denial-of-Service (DDoS) attacks, send spam, steal private information, etc. [0003] The current P2P botnet detection system mostly realizes the detection of zombie nodes by monitoring network traffic. However, with the rapid development of network link bandwidth and Internet business traffic, the computing and storage overhead required...

AI Technical Summary

Problems solved by technology

[0004] However, none of the above sampling methods are specifically designed for P2P botnet detection, so in the P2P botnet detection system based on network traffic, as long as the network traffic sampled by the above sampling methods is used, the detection accuracy of P2P botnet cannot be achieved. to avoid being affected

A large number of packets related to P2P botnets may be discarded, while most of the sampled packets may not be related to P2P botnets

Images