Botnet distributed real-time detection method and system

Abstract

The invention discloses a botnet distributed real-time detection method and system. The botnet distributed real-time detection method comprises the steps of generating a network flow metadata Netflow information and sending the network flow metadata Netflow information to a data detection component by a data generation component; extracting multiple training detection characteristics from marked training data and establishing a detection model serving as a detection standard of a real-time detection unit by a detection model training unit of the data detection component; and by the real-time detection unit of the data detection component, receiving the Netflow information sent in real time, extracting multiple detection characteristics and comparing with the detection model, and obtaining alarm information including a detection object identifier when the comparison result is matched, and comparing the alarm information with a blacklist and a whitelist of a host to obtain a confirmed controlled bot host and a doubtful controlled bot host. The scheme of the botnet distributed real-time detection method and system not only can be applied to an enterprise network with gigabit flow, but also can be applied to a ISPs network; and the overall detection performance of the botnet detection is improved.

Description

technical field [0001] The invention relates to the communication field, in particular to a distributed real-time detection method and system for a botnet. Background technique [0002] At present, global Internet security threats are in a stage of profound change, and the attacker's attack purpose has shifted from targeting the network architecture itself so that it cannot be used normally to targeting ordinary users and related organizations. This new type of attack directly affects the daily lives of Internet users around the world, threatening the security of enterprise users and government networks. For example, computer users are suffering from spyware spying on their sensitive information, spam flooding their email accounts, phishing websites stealing authentication data, etc. At the heart of these attacks are large numbers of controlled computers, which may be located in homes, schools, businesses or governments around the world. Attackers use these controlled host...

AI Technical Summary

Problems solved by technology

This type of method has a large time cost in the feature extraction stage, and is only applicable to the enterprise Gigabit network environment, and it is difficult to apply to the 10 Gigabit enterprise environment (serious packet loss), and it is even more difficult to apply to the ISPs customer environment.

Images