Botnet traffic detection method based on parallel neural network

Abstract

The invention relates to a Botnet traffic detection method based on a parallel neural network. The method comprises the following steps: dividing an original network traffic pcap file into a plurality of network flows according to a data packet transmission quintuple <a source IP, a destination IP, a source port, a destination port, a transmission protocol>; preprocessing and converting each network flow into input formats of two neural networks; extracting spatial features of the network flow grey-scale map by using a convolutional neural network, and outputting a 10-dimensional feature vector; extracting time sequence characteristics of a network flow sequence by utilizing a gating circulation unit network, and outputting a 10-dimensional vector; splicing the features extracted by the two neural networks by using a serial feature fusion scheme, and outputting 20-dimensional features; carrying out model training through a softmax classifier, and outputting a zombie flow detection model; and finally, pre-processing the captured traffic data of the target network, and inputting the pre-processed traffic data into the model to complete the detection of the Botnet traffic. The method is high in accuracy and can effectively detect the Botnet traffic.

Description

technical field [0001] The invention belongs to the technical field of network security, and relates to a botnet traffic detection method based on a parallel neural network. Background technique [0002] A botnet refers to a computer cluster controlled by a network attacker through an infection of a Trojan horse or a bot program due to computer security vulnerabilities. Its important feature is that the attacker can manipulate the controlled host to execute the same malicious program through a one-to-many command and control channel. Commands, such as simultaneously controlling the host to launch a DDOS attack on a target website or sending a large amount of spam to a certain server. In recent years, the Internet of Things technology has continued to develop, and the scale of the Internet of Things industry has continued to expand, followed by the massive deployment of Internet of Things devices, which provides favorable conditions for the breeding of botnet activities. Botn...

AI Technical Summary

Problems solved by technology

This algorithm solves the problems of traditional machine learning algorithms relying on artificially designed features and extracting feature dimensions. It can automatically extract the spatio-temporal features of network flows from raw data by using neural networks.

Images