A p2p botnet detection system and method based on traffic analysis

Abstract

The invention discloses a P2P botnet detection system based on traffic analysis, which belongs to the field of computer network security, and includes a network traffic receiving module to obtain network traffic from different monitoring points, a communication structure diagram construction module, and a detection algorithm module from the communication structure diagram. The community discovery algorithm discovers the P2P structure, uses two machine learning methods of decision tree and Bayesian network to detect the P2P botnet, tracks the communication with other nodes to expand the botnet, and stores the relevant data in the database module. The invention also discloses a P2P zombie network detection method based on flow analysis. The present invention does not use the port as a feature to prevent detection failure caused by port randomization, and conducts P2P botnet detection based on traffic analysis, improves detection efficiency by filtering benign network traffic, uses packet length as a feature to reduce data processing, and can efficiently identify P2P bots Network communication provides support for the intrusion detection system.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a P2P botnet detection system and method based on flow analysis. Background technique [0002] A botnet (Botnet) is a large number of hosts controlled by attackers on the Internet, using C&C (Command and Control) channels to control and issue commands to hosts existing in the botnet. Botnets are usually used to launch Distributed Denial-of-Service (DDoS) attacks, send spam, bitcoin mining and other attacks. [0003] P2P (Peer-to-Peer) peer-to-peer network, also known as peer-to-peer technology, each node has the same ability, usually does not rely on a central node. The decentralized nature of P2P networks makes them difficult to detect, and the distributed nature is also excellent against single points of failure. At the beginning of the 21st century, users began to have more and more powerful servers, storage space, and bandwidth, and the share of the P2P-structured I...

AI Technical Summary

Problems solved by technology

[0005] The initial botnet detection work is to use the port and signature method to detect the traffic packet information of a specific port. Once this detection method encounters an encrypted botnet or a botnet that uses randomization for communication ports, it will not be effective.

[0006] Some subsequent detection methods use graph clustering technology to detect P2P traffic, but do not analyze benign P2P traffic. The problem is that the detection consumes a lot of computing resources and the detection efficiency is low. In addition, this method also has the problem that the graph may not be scalable. question

Images