Botnet detection method and system and storage medium

Abstract

The invention discloses a botnet detection method and system and a storage medium, and the method comprises the steps: obtaining the original network flow data in a monitored network, carrying out thepreprocessing of the original network flow data, and obtaining the preprocessed network flow data; constructing a terminal access relation graph based on the preprocessed network traffic data; and mining a plurality of terminal identification lists accessing the same domain name from the terminal access relation graph to obtain a candidate node combination, and screening the candidate node combination based on a preset screening rule to obtain a botnet node detection result. According to the scheme, the types of the applied data are few, the number of the features extracted from the data flowis small, the calculation overhead is small, the detection efficiency can be effectively improved, detection does not need to be carried out based on the known botnet behavior features, and the scheme can be better applied to detection of unknown botnet threats.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a botnet detection method, system and storage medium. Background technique [0002] Botnet refers to the use of one or more means of transmission to make a large number of hosts infected with bot programs (BOT programs) virus, thus forming a one-to-many command and control (Command and Control) between the controller and the infected hosts. and Control, C&C) network. Attackers spread bots through various channels to infect a large number of hosts on the Internet, and the infected hosts accept instructions from attackers through a control channel to form a botnet. This attack method provides the attacker with a hidden, flexible and efficient one-to-many command and control mechanism, enabling the attacker to achieve information theft, distributed denial of attack and spam sending, and has become an important aspect of the current network security field. threaten. [00...

AI Technical Summary

Problems solved by technology

However, these methods require a variety of data information, huge data streams, and need to analyze data packets to extract multiple features, and the processing load is too large, resulting in low detection efficiency of botnets

Images