Zombie network control node detection method and device

Abstract

The invention discloses a zombie network control node detection method and device, and the method comprises the steps: generating a high-frequency network segment according to the IP of a current zombie network control node, so as to rapidly locate the position of a suspicious network control node; obtaining an initial suspicious network control node set according to the current state of the portof the high-frequency network segment IP, and obtaining a suspicious network control node list with a preset common port list; filtering according to the suspicious network control node list to obtaina high suspicious network control node list; performing matching and protocol detection according to the highly suspicious network control node list and the port list of the zombie network family; performing protocol verification on the highly suspicious network control nodes in the highly suspicious network control node list according to the classification result; and obtaining the network control node of the corresponding zombie network family according to the family protocol. The method accelerates automatic active analysis and detection of zombie network control nodes, detects more unknown zombie network control nodes, improves the detection efficiency, and improves the scanning efficiency.

Description

technical field [0001] The invention relates to the field of computer application technology, in particular to a detection method and device for a botnet control node. Background technique [0002] Three steps are required to realize the automated botnet monitoring process. First, family identification and reverse analysis of family communication protocols; second, automated monitoring and protocol analysis scripts; finally, batch input of botnet control nodes for batch automated monitoring. After the first two steps are completed, more active botnet control nodes need to be input to realize intensive monitoring of single-family botnets and generate more monitoring data. [0003] Obtain detected samples through VirusTotal for sample extraction to obtain botnet control nodes. Extracting botnet control nodes through samples is a relatively fast way. However, since VirusTotal cannot ensure that the latest samples of the same family can be completely captured, it is impossible ...

AI Technical Summary

Problems solved by technology

Extracting botnet control nodes through samples is a relatively fast way. However, since VirusTotal cannot ensure that the latest samples of the same family can be completely captured, it is impossible to fully obtain the latest botnet control nodes, and the general network control node detection method consumes time, low accuracy

Images