A Botnet Discovery Method Based on Nonparametric Statistics

Abstract

A zombie network discovery method based on non-parameter statistics comprises the following steps: step 1, establishing a non-parameter scanning statistics model; step 2, tree priori: graph structuredata are approximated into a tree structure form convenient to process, and the tree structure adopted by the approximation mode comprises a width-first search tree, a random scanning spanning tree and a Steiner tree; and step 3, discovering the zombie network through multilayer dynamic programming based on tree priori.

Description

technical field [0001] The invention relates to a network security technology, and mainly relates to a botnet discovery method based on non-parameter statistics. Background technique [0002] In the field of network security, botnets have become a very common threat. Thousands of compromised hosts were programmed into botnets controlled by the attackers through command and control channels. Botnets have enabled cybercrime, including distributed denial-of-service (DDoS) attacks, spam, identity theft, and more. Since bot masters rely on C&C channels to command attacked machines and receive messages from bots, C&C channels serve as a key element of the botnet. [0003] Common structures of C&C channels include centralized architectures and P2P structures. In a centralized structure, all bots connect to one or a very limited server owned by the attacker. However, such an infrastructure introduces a potential disadvantage, a single point of failure. To overcome this weakness...

AI Technical Summary

Problems solved by technology

[0005] The detection of botnets is very important, however, the increasing number of members in P2P structured botnets makes the extraction of target subnets more difficult

Traditional statistical methods alone (e.g. P2P-related network characteristics such as peer churn rate, traffic, etc.; or characteristics at the node or edge level, such as number of neighbors, type of protocol used, connection duration, etc., may not be sufficient to accurately detect bots network, and cannot reflect the dynamics of the entire graph well

Images