A method for detecting botnets based on c&c communication state transition

Abstract

The invention provides a method for detecting a botnet based on C&C communication state transition, comprising a training stage, namely dividing a training set data flow in quaternion and adding tags,extracting features, generating a state chain, constructing a candidate model library and calculating a probability threshold value; and a prediction stage, namely dividing a to-be-detected data flowin the quaternion, extracting the features and generating a to-be-detected state chain; extracting a protocol type, matching with models in the candidate model library one by one, if the protocol type is not matched with the models, discarding the protocol type, if the protocol type is successfully matched, executing the next step; calculating a test probability, and matching according to a preset scheme, if the test probability is not matched with the preset scheme, discarding the test probability, otherwise saving the model and the test probability; and finally selecting the model with thehighest matching rate as a finish model from the candidate models which are successfully matched, and judging that whether the to-be-detected data flow is the botnet or not by virtue of the tag of thefinish model. A state of the flow can be easily extracted, complex statistical work and flow content extract do not need to be carried out, detection performance is improved, a Markov chain for detection is established by adopting a state transition relation, and efficiency is high.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for detecting botnets based on C&C communication state transitions. Background technique [0002] The full name of the C&C server is Command and Control Server, that is, "command and control server". With the development of the malicious Trojan horse industry, many Trojan horses have already got rid of the previous "single-handed" combat method, but are interconnected through the network, and by commanding a large number of infected computers to act together, they can exert a synergistic effect. In this way, they can not only concentrate on attacking a certain target at the same time, but also disperse the risks they bear. Among them, the key node for command is the C&C server. These servers are used to control DDoS botnets, spam networks, banking Trojans, and servers used to spread collected data for phishing and malware infections. On the one hand, the C&C ...

AI Technical Summary

Problems solved by technology

[0013] The above classification initially summarizes the differences of existing detection technologies from different aspects, but it lacks pertinence and does not consider the characteristics of C&C communication in botnets, especially the state and periodicity between C&C communication. Starting from this, we invented A method for detecting botnets based on C&C communication state transitions

Images