Botnet detection device based on HTTP first question and answer packet clustering analysis

Abstract

The invention discloses a botnet detection device based on HTTP first question and answer packet clustering analysis, and relates to the field of information technology. The botnet detection device iscomposed of an HTTP head field statistical feature extraction module, a botnet traffic recording module, a request packet and response packet content acquisition module, a feature vector extraction module, a clustering module, a feature code generation module and a rule generator, wherein the feature code generation module consists of a single feature code generator, a feature code combiner and afeature code trimmer. The botnet detection device does not depend on priori knowledge, does not need a large amount of manual intervention, and can automatically extract and generate high-quality feature codes from HTTP botnet traffic. The feature code detection can be added into an intrusion detection system to be used for rapid and wide botnet threat perception and botnet family classification,and wide and rapid botnet host discovery is achieved.

Description

technical field [0001] The present invention relates to the field of information technology, especially the field of information security technology. Background technique [0002] After years of development and evolution of botnets, the HTTP protocol has become one of the mainstream control protocols for botnets due to its good business carrying capacity and penetration capability of border defense. Typical spam botnets, such as Rustock, Kelihos, etc., and typical stealing botnets, such as Spyeye, Tinba, etc., all use the HTTP protocol for C&C communication. At present, among the detection devices for the botnet of the HTTP protocol, the two most common methods are based on statistical characteristics of data flow and deep inspection based on data packets. [0003] The method based on the statistical characteristics of the data flow does not depend on the specific content, and can detect encrypted communication traffic, but due to the lack of payload content, the signature ...

AI Technical Summary

Problems solved by technology

This method can quickly discover botnets with this characteristic communication, but the disadvantage is that it cannot detect botnets with encrypted communication, and extracting the characteristics of the User-Agent field requires preparing a large number of samples and analyzing error types, and the overall work is time-consuming and labor-intensive.

Images