A c&c channel discrimination method and system

Abstract

The present invention provides a method and system for discriminating C&C channels, including: obtaining traffic to be identified; classifying the traffic to be identified based on behavioral descriptions, and obtaining several original features with a preset number of categories and preset numbers of behavioral features ; Perform feature selection on the several original features to obtain behavioral characteristics to be judged; identify the behavioral characteristics to be judged based on a preset machine learning algorithm, and obtain a time slot channel type inference result; The result of inferring the slot channel type is comprehensively judged, and the judgment result of the C&C channel architecture type is obtained. By monitoring the network traffic of a single host, the proposed mechanism of behavioral characteristics, time slot division, reasoning and comprehensive judgment is applicable to malicious programs with complex network behaviors, and the feature selection method is used to effectively improve the accuracy of the judgment under the premise of ensuring the correctness of the judgment. Speed ​​of channel architecture type analysis.

Description

A C&C channel discrimination method and system technical field [0001] The present invention relates to the technical field of network security, and in particular, to a C&C channel discrimination method and system. Background technique C&C channel (Command&Control Channel: C&C Channel) is botnet program, and Trojan horse etc. An essential functional component of advanced cyber malware. The C&C channel is responsible for running malicious programs as well as controlling the server / Attackers constantly transmit the latest operation and attack commands, the status of infected hosts and devices, and command execution results. information, so that attackers can fully grasp the current attack situation, support subsequent attack decisions, and realize combined attacks. In short, C& The function undertaken by the C channel is particularly important and indispensable. Therefore, after detecting the existence of the C&C channel, it is related to itself Accurate and in-de...

AI Technical Summary

Problems solved by technology

[0005] However, the above-mentioned main C&C channel architecture type identification methods all have some limitations

The discriminant method based on group analysis needs to monitor a certain number of infected hosts / network malicious program nodes, and even the entire monitored network at the same time, and its deployment and use conditions are relatively high. Not only is it not practical, but it cannot be used to analyze and protect network scenarios In , there are only a few or even a single infected host

Although the analysis and discrimination method based on a single host does not have the above limitations, many of them can only give malicious label judgments such as certain types of malicious programs / botnets, and cannot distinguish between P2P and C&S type C&C channels

Although some methods can distinguish P2P and C&S type C&C channels, the training and analysis process of the discriminant model takes too long. The timely deployment and deployment of measures have a negative impact

Images