Botnet detection method and system

Abstract

The application discloses a botnet detection method and system, and belongs to the technical field of network security. Firstly, current behavior data of each network node in a unit time length is collected. Then, the matching value of the behavior data between nodes is calculated to quantify the coordination degree of the nodes in three dimensions of time sequence synchronization, behavior similarity and communication graph structure. When multiple nodes have the same matching value, the nodes are determined as a network node group. Finally, the botnet node is confirmed by verifying the behavior consistency of the node group in continuous multiple historical periods. The botnet detection method provided by the application adopts multi-dimensional coordination analysis combined with a historical continuity verification mechanism, effectively overcomes the limitations of traditional single-node detection, significantly improves the detection accuracy and greatly reduces the false positive rate, and is suitable for real-time security protection in a large-scale network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security detection, and in particular to a botnet detection method and system. BACKGROUND

[0002] Botnet is a cluster composed of network nodes such as servers, computers, Internet of Things devices, etc. infected by malicious software, controlled remotely by attackers, and used to launch distributed denial of service attacks, data theft, and other malicious behaviors.

[0003] Traditional detection methods are mostly based on single-node behavior analysis, such as traffic anomaly detection, etc. However, the traditional detection methods have low accuracy, and for large-scale botnet attacks, the timeliness of detection is poor and cannot respond in time. SUMMARY

[0004] The present application provides a botnet detection method and system to improve the above problems.

[0005] To achieve the above purpose, the present application adopts the following technical solutions:

[0006] The present application provides a botnet detection method, comprising:

[0007] Obtaining a plurality of current behavior data corresponding to a plurality of network nodes in a current running period, the duration of the current running period being a unit duration;

[0008] Based on the current behavior data corresponding to each network node and the current behavior data corresponding to the remaining network nodes, obtaining a matching value, wherein the matching value is used to represent the degree of cooperation of the plurality of current behavior data in the time sequence and statistical characteristics;

[0009] If there are a plurality of same matching values, it is determined that a plurality of corresponding network nodes constitute a network node group;

[0010] Determining a botnet node based on the network node group.

[0011] In combination with the first aspect, in some embodiments, based on the current behavior data corresponding to each network node and the current behavior data corresponding to the remaining network nodes, obtaining a matching value, wherein the matching value is used to represent the degree of cooperation of the plurality of current behavior data in the time sequence and statistical characteristics, comprising:

[0012] Obtaining historical data corresponding to each network node, the historical data including a plurality of historical behavior data corresponding to a plurality of historical periods of unit duration;

[0013] Based on each current behavior data and the corresponding historical data, determining a plurality of risk nodes from the plurality of network nodes;

[0014] Based on the current behavior data corresponding to each risk node and the current behavior data corresponding to the remaining risk nodes, a matching value is obtained.

[0015] In combination with the first aspect, in some embodiments, based on each current behavior data and the corresponding historical data, a plurality of risk nodes are determined from the plurality of network nodes, including:

[0016] Based on the historical data, a historical baseline model corresponding to each network node is constructed;

[0017] The current behavior data is brought into the historical baseline model, and a deviation score output by the historical baseline model is obtained, wherein the historical baseline model is used to output a predicted deviation score according to the input running data, and the deviation score is used to represent the deviation degree between the input running data and the plurality of historical behavior data;

[0018] A preset deviation threshold is obtained, and if the deviation score is greater than the preset deviation threshold, the corresponding network node is determined as a risk node.

[0019] In combination with the first aspect, in some embodiments, based on the current behavior data corresponding to each network node and the current behavior data corresponding to the remaining network nodes, a matching value is obtained, wherein the matching value is used to represent the coordination degree of the plurality of current behavior data in time sequence and statistical characteristics, including:

[0020] A time sequence synchronization coordination degree corresponding to a first dimension is obtained;

[0021] A behavior similarity coordination degree corresponding to a second dimension is obtained;

[0022] A communication graph structural coordination degree corresponding to a third dimension is obtained;

[0023] The matching value is determined based on the time sequence synchronization coordination degree, the behavior similarity coordination degree, and the communication graph structural coordination degree.

[0024] In combination with the first aspect, in some embodiments, the time sequence synchronization coordination degree corresponding to the first dimension is obtained, including:

[0025] The continuous behavior data existing in the current behavior data is converted into an abnormal event sequence, and a corresponding timestamp is obtained;

[0026] For any two current behavior data with abnormal event sequences, if within a sliding time window, the two current behavior data have the same abnormal time sequence, it is recorded as a coincidence, and the corresponding network node is a suspicious node;

[0027] The number of coincidences of the abnormal time sequences between all suspicious nodes is calculated, and a time sequence synchronization coordination degree is obtained based on the number of coincidences.

[0028] In combination with the first aspect, in some embodiments, the behavior similarity synergy degree corresponding to the second dimension is obtained by:

[0029] The behavior feature vector of each current behavior data is obtained, and the behavior feature vector includes: average transmitted data packet size, connection duration, target port entropy value.

[0030] A similarity matrix is constructed based on all the behavior feature vectors, and a clustering profile coefficient corresponding to the similarity matrix is obtained, and the clustering profile coefficient is taken as the similarity synergy degree.

[0031] In combination with the first aspect, in some embodiments, the communication graph structural synergy degree corresponding to the third dimension is obtained by:

[0032] Network connection data is obtained based on the current behavior data, and a target communication bipartite graph of network nodes and external nodes is constructed based on the network connection data.

[0033] The graph centrality index of the external nodes in the target communication bipartite graph is obtained.

[0034] The communication graph structural synergy degree is determined based on the graph centrality index.

[0035] In combination with the first aspect, in some embodiments, the botnet node is determined based on the network node group by:

[0036] If the current behavior data corresponding to the network nodes in the network node group and the historical behavior data corresponding to at least N continuous historical periods are consistent, the risk node belonging to the risk node group is determined as the botnet node, where N is an integer greater than 2.

[0037] The second aspect, the embodiments of the present application also propose a botnet detection system, the system is configured to:

[0038] A plurality of current behavior data corresponding to a plurality of network nodes in a current running period is obtained, and the time length of the current running period is a unit time length.

[0039] Based on the current behavior data corresponding to each network node and the current behavior data corresponding to the remaining network nodes, a matching value is obtained, wherein the matching value is used to represent the synergy degree of the plurality of current behavior data in the time sequence and the statistical characteristics.

[0040] If there are a plurality of same matching values, it is determined that the plurality of corresponding network nodes constitute a risk node group.

[0041] The botnet node is determined based on the network node group.

[0042] In combination with the second aspect, in some embodiments, the system is configured to:

[0043] Based on the current behavior data corresponding to each network node, a matching value is obtained with the current behavior data corresponding to the remaining network nodes. This matching value characterizes the degree of synergy among multiple current behavior data sets in terms of temporal and statistical features, including:

[0044] Acquire historical data for each network node. The historical data includes multiple historical behavior data corresponding to historical periods of multiple unit durations.

[0045] Based on each current behavior data and its corresponding historical data, multiple risk nodes are identified from multiple network nodes;

[0046] Based on the current behavior data corresponding to each risk node, a matching value is obtained with the current behavior data corresponding to the other risk nodes.

[0047] In conjunction with the second aspect, in some implementations, the system is configured to: identify multiple risk nodes from multiple network nodes based on each current behavior data and its corresponding historical data, including:

[0048] Based on historical data, construct a historical baseline model for each network node;

[0049] The current behavior data is fed into the historical baseline model, and the deviation score output by the historical baseline model is obtained. The historical baseline model is used to output the predicted deviation score based on the input running data. The deviation score is used to characterize the degree of deviation between the input running data and multiple historical behavior data.

[0050] Obtain a preset deviation threshold. If the deviation score is greater than the preset deviation threshold, the corresponding network node is determined to be a risk node.

[0051] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0052] Based on the current behavior data corresponding to each network node, a matching value is obtained with the current behavior data corresponding to the remaining network nodes. This matching value characterizes the degree of synergy among multiple current behavior data sets in terms of temporal and statistical features, including:

[0053] Obtain the temporal synchronization coordination degree corresponding to the first dimension;

[0054] Obtain the behavioral similarity synergy corresponding to the second dimension;

[0055] Obtain the structural synergy degree of the communication graph corresponding to the third dimension;

[0056] Matching values ​​are determined based on temporal synchronization coordination, behavioral similarity coordination, and communication graph structural coordination.

[0057] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0058] Obtain the temporal synchronization coordination degree corresponding to the first dimension, including:

[0059] Transform the continuous behavioral data in the current behavioral data into an abnormal event sequence and obtain the corresponding timestamps;

[0060] For any two current behavior data with abnormal event sequences, if the two current behavior data have the same abnormal time sequence within a sliding time window, it is recorded as an overlap, and the corresponding network node is a suspicious node.

[0061] Calculate the number of overlaps in the abnormal time series between all pairs of suspicious nodes, and determine the temporal synchronization degree based on the number of overlaps.

[0062] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0063] Obtain the behavioral similarity synergy corresponding to the second dimension, including:

[0064] Obtain the behavior feature vector for each current behavior data. The behavior feature vector includes: average data packet size sent, connection duration, and target port entropy value.

[0065] A similarity matrix is ​​constructed based on all behavioral feature vectors, and the clustering profile coefficients corresponding to the similarity matrix are obtained. The clustering profile coefficients are then used as the similarity synergy.

[0066] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0067] Obtain the structural synergy degree of the communication graph corresponding to the third dimension, including:

[0068] Network connection data is obtained based on current behavior data, and a target communication bipartite graph between network nodes and external nodes is constructed based on the network connection data;

[0069] Obtain the graph centrality index of external nodes in the target communication bipartite graph;

[0070] Based on the graph centrality index, the structural synergy of the communication graph is determined.

[0071] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0072] Zombie network nodes are identified based on network node groups, including:

[0073] If the current behavior data of a network node belonging to a network node group is consistent with the historical behavior data corresponding to at least N consecutive historical periods, then the risk node belonging to the risk node group is determined to be a zombie network node, where N is an integer greater than 2.

[0074] A third aspect of this invention provides an electronic device, which includes:

[0075] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method proposed in the first aspect of the present invention.

[0076] A fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in the first aspect of the present invention.

[0077] In summary, the above methods and systems have the following technical effects:

[0078] This invention discloses a botnet detection method and system, achieving efficient and accurate botnet identification through the following steps: First, collecting current behavior data of each network node within a unit of time; then, quantifying their coordination in three dimensions—temporal synchronization, behavioral similarity, and communication graph structure—by calculating the matching value of the behavioral data between nodes; when multiple nodes have the same matching value, they are identified as a network node group; finally, confirming the botnet node by verifying the behavioral consistency of the node group over multiple consecutive historical periods. The botnet detection method proposed in this invention employs multi-dimensional collaborative analysis combined with a historical continuous verification mechanism, effectively overcoming the limitations of traditional single-node detection, significantly improving detection accuracy and greatly reducing false alarm rates, and is suitable for real-time security protection in large-scale network environments. Attached Figure Description

[0079] Figure 1 This is a flowchart illustrating a botnet detection method proposed in an embodiment of this application. Detailed Implementation

[0080] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0081] This application provides a method for detecting botnet attacks. Please refer to [link to relevant documentation]. Figure 1This includes the following steps:

[0082] S101: Obtain multiple current behavior data of multiple network nodes in the current running cycle, where the duration of the current running cycle is in units of time.

[0083] Multiple network nodes refer to numerous device entities within the monitored network, such as servers, personal computers, and IoT devices. As can be understood, the essence of a botnet is a network—a group of nodes under coordinated control. The abnormal behavior of a single node may simply be a common malfunction or an individual attack; therefore, the coordination exhibited by multiple nodes is the core characteristic of a botnet. In this embodiment, current behavior data refers to specific data indicators collected from each network node within the current operating cycle, quantifying its network activity and status. This is raw, multi-dimensional data.

[0084] S102: Based on the current behavior data corresponding to each network node, obtain a matching value with the current behavior data corresponding to the other network nodes. The matching value is used to characterize the degree of synergy of multiple current behavior data in terms of temporal and statistical features.

[0085] Understandably, since the coordination exhibited by individual nodes is the core characteristic of botnets, this application needs to identify whether there are signs of coordinated attacks among multiple nodes. Therefore, in this embodiment, coordination can be measured by matching values.

[0086] Therefore, in this embodiment, the temporal synchronization coordination degree corresponding to the first dimension can be obtained first.

[0087] For example, continuous behavioral data in the current behavioral data can be transformed into an abnormal event sequence and the corresponding timestamp can be obtained. Then, for any two current behavioral data with abnormal event sequences, if the two current behavioral data have the same abnormal time sequence within a sliding time window, it is recorded as an overlap, and the corresponding network node is a suspicious node. Finally, the number of overlaps of the abnormal time sequences between all suspicious nodes is calculated, and the temporal synchronization coordination degree is based on the number of overlaps.

[0088] Understandably, in order to simplify complex data and focus on key and noteworthy behavioral points, in this embodiment, the raw and continuous behavioral data (such as traffic logs) generated by each network node within a "unit of time" can be converted into a sequence consisting of "abnormal events" and their "timestamps".

[0089] For example, if node A has tens of thousands of network connection records within 5 minutes, then "initiating connections to more than 50 different IPs within 1 second" can be defined as a "port scan" anomaly event. Of course, in other embodiments, some other operations can be adaptively defined, which are not limited in this application.

[0090] In this application, the sliding time window is key to tolerating microsecond-level time deviations, acknowledging that cooperative actions cannot be perfectly accurate to the millisecond due to factors such as network latency.

[0091] For example, compare the sequences of nodes A and B:

[0092] Port A performs a "port scan" at 10:01:03, and B performs a similar event at 10:01:04. 10:01:04 - 10:01:03 = 1 second < 2 seconds, therefore this is considered an overlap.

[0093] Event A occurs at 10:03:45, and event B occurs at 10:03:44. The time difference is 1 second, which is considered an overlap.

[0094] Understandably, nodes A and B are marked as suspicious nodes because both events successfully match. If the event timestamp of another node C has a large difference from the event timestamps of A and B, it will not be marked as a suspicious node related to A or B.

[0095] Furthermore, among all the marked "suspicious nodes," the number of overlaps for each pair of nodes (e.g., AB, AC, BC) is counted. Then, a final temporal synchronization coordination score is calculated based on these overlaps. That is, a quantitative coordination score is obtained. The more overlaps, the higher the coordination score. Understandably, the "overlap count" is divided by the length of the shorter anomalous event sequence between the two nodes. This avoids misjudging an abnormally active node and an occasionally active node as having low coordination simply because of a small absolute number of overlaps.

[0096] For example, node A has 10 abnormal events and node B has 5 abnormal events, with 4 overlaps between them.

[0097] Their synergy score can be calculated as 4 / min(10,5)=4 / 5=0.8.

[0098] Final score: This 0.8 is the matching value of nodes A and B in the dimension of temporal synchronization, that is, the degree of coordination. A high value means that they are controlled by the same instruction source.

[0099] Furthermore, the behavioral similarity synergy corresponding to the second dimension can be obtained.

[0100] Specifically, as an example, a behavioral feature vector can be obtained for each current behavioral data. The behavioral feature vector includes: average data packet size sent, connection duration, and target port entropy value. Then, a similarity matrix is ​​constructed based on all behavioral feature vectors, and the clustering profile coefficients corresponding to the similarity matrix are obtained. The clustering profile coefficients are used as the similarity synergy.

[0101] Understandably, a set of predefined, quantifiable statistical features is extracted from the current behavior data of each network node to form a vector. In this embodiment, the three selected features are merely examples. In other embodiments, other features may be used, which are not limited here.

[0102] For example, the average packet size sent can be the average size of all packets sent by the node within a statistical period. Different malicious behaviors can produce packets of specific sizes. For example, heartbeat packets are typically small, while some payloads in data leaks or DDoS attacks may be larger. Nodes within the same botnet tend to have similar packet size distributions due to performing the same tasks. Different activities such as server communication patterns, scanning behavior, and malware downloads result in significantly different connection durations. Short connections may indicate scanning, while long connections may indicate continuous C&C communication or data theft. Zombie nodes controlled by the same instructions will exhibit similar connection patterns. Target port entropy measures the uncertainty or randomness of the target port numbers a node connects to. If it always connects to a few specific ports, the entropy is low; if it randomly connects to a large number of different ports, the entropy is high.

[0103] As an example:

[0104] Node A vector: [Average packet size: 150 bytes, average connection duration: 2 seconds, port entropy: 4.5]

[0105] Node B vector: [Average packet size: 148 bytes, average connection duration: 1.8 seconds, port entropy: 4.6]

[0106] Node C vector: [Average packet size: 1024 bytes, average connection duration: 300 seconds, port entropy: 1.2]

[0107] Intuitively, nodes A and B are very similar, while node C is quite different.

[0108] To visualize global similarity relationships, the similarity between the behavioral feature vectors of every two nodes in the network is calculated, for example, using cosine similarity, Euclidean distance, etc. All pairwise similarity values ​​are then filled into a matrix; this matrix is ​​the similarity matrix.

[0109] Since it's uncertain whether one or more highly coordinated groups exist within the current network, a single similarity value is not used directly. Instead, global coordination is indirectly measured by evaluating clustering results. The clustering algorithm can be any publicly available algorithm such as K-Means or DBSCAN, and is not limited here. All nodes are grouped based on the similarity matrix.

[0110] Understandably, if the value range is limited to [-1, 1], a value close to 1 indicates that nodes within a cluster are very similar, i.e., tightly clustered, and that nodes between clusters are significantly different. This implies the existence of combinations in the network with highly consistent behavior that are distinct from other nodes, a typical characteristic of botnets. Therefore, a high profile coefficient directly corresponds to a high degree of behavioral similarity and synergy.

[0111] Furthermore, the structural synergy degree of the communication graph corresponding to the third dimension can be obtained.

[0112] For example, network connection data can be obtained based on current behavior data, and a target communication bipartite graph between network nodes and external nodes can be constructed based on the network connection data. Then, the graph centrality index of external nodes in the target communication bipartite graph can be obtained. Finally, the structural synergy of the communication graph can be determined based on the graph centrality index.

[0113] Specifically, a bipartite graph is a special type of graph whose vertices can be divided into two disjoint sets (e.g., set U and set V), and each edge in the graph connects a vertex in set U to a vertex in set V. Vertices within the same set are not directly connected by edges.

[0114] In this application, set U (first type of nodes) refers to the internal network nodes to be detected, i.e., those devices that we suspect might be botnets. Set V (second type of nodes) refers to external nodes that communicate with the internal nodes, which can be any IP address on the Internet (such as C&C servers, the attacked target server, other network nodes, etc.). If internal node A has communicated with external node X within the statistical period, an edge is established between A and X.

[0115] For example, suppose there are 3 internal nodes (A, B, C) and 4 external nodes (X, Y, Z, W). The communication logs show:

[0116] Node A connects X and Y.

[0117] Node B connects X and Z.

[0118] Node C connects Y and W.

[0119] Therefore, external node X is connected by A and B, with a degree centrality of 2; external node Y is connected by A and C, with a degree centrality of 2; external nodes Z and W are each connected by only one internal node, with a degree centrality of 1.

[0120] Understandably, the importance of a node depends on the importance of its neighboring nodes. Even if an external node is only connected to a few internal nodes, it may still be important if those internal nodes themselves are connected to many other important external nodes. In other words, if an external node is simultaneously connected to by a large number of internal nodes, it is highly likely to be a command and control server, or a common target of a coordinated attack.

[0121] For a specific calculation process, for example, all external nodes can be traversed. For each internal node, if it is connected to an external node, the vector dimension value of that external node is the centrality index of that external node; if it is not connected, the value is 0.

[0122] Therefore, taking this embodiment as an example:

[0123] The connection vector of node A is: [X:2,Y:2,Z:0,W:0]->(2,2,0,0).

[0124] The connection vector of node B is: [X:2,Y:0,Z:1,W:0]->(2,0,1,0)

[0125] The connection vector of node C is: [X:0,Y:2,Z:0,W:1]->(0,2,0,1)

[0126] Understandably, we calculate the pairwise similarity between these connection preference vectors. This measures their consistency in selecting important communication targets.

[0127] Similar to behavioral similarity synergy, clustering is performed based on this similarity matrix, and silhouette coefficients are calculated. A high silhouette coefficient indicates the existence of an internal subset of nodes that tend to connect to the same set of highly central external nodes, suggesting strong structural synergy.

[0128] In other embodiments, the average or median similarity among all pairs of internal nodes can be directly calculated as an overall synergy indicator. The specific calculation method is not limited in this application. Since the core of a botnet is unified command by a C&C server, discovering a group of internal nodes communicating with a common, highly centralized external node is one of the most conclusive pieces of evidence of a botnet.

[0129] Furthermore, in this embodiment, the matching value is determined based on the temporal synchronization coordination degree, the behavioral similarity coordination degree, and the communication graph structural coordination degree.

[0130] In this embodiment, different weights can be assigned to data of different dimensions based on the actual situation to obtain a matching value. The specific weights can be determined by security experts based on experience and historical data, and are not limited in this application.

[0131] Understandably, each dimension can capture different aspects of the collaborative behavior of botnets, complementing each other to form a three-dimensional defense.

[0132] For example, the temporal synchronization coordination degree can directly capture the coordination between the issuance and execution of attack commands, which is a strong evidence. However, if the botnet uses low-frequency, asynchronous commands, or if the data collection time window misses some brief synchronization peaks, this dimension may fail.

[0133] Behavioral similarity coordination statistically reflects the consistency of long-term behavioral patterns. It doesn't require high instantaneous synchronization of attack commands and can detect persistent coordinated tasks. However, two normal servers of the same type (such as two web servers) may also exhibit high behavioral similarity, leading to false positives. Communication graph structure coordination is less effective if the botnet uses a P2P architecture or Fast-Flux technology to hide its C&C servers. Therefore, any one dimension can be specifically circumvented by malware designers, but circumventing all three simultaneously is extremely difficult. Therefore, combining all three dimensions can significantly improve detection robustness and accuracy.

[0134] Optionally, in other embodiments, historical data corresponding to each network node can also be obtained. The historical data includes multiple historical behavior data corresponding to multiple historical periods of multiple unit durations. Based on each current behavior data and the corresponding historical data, multiple risk nodes are determined from multiple network nodes. Based on the current behavior data corresponding to each risk node and the current behavior data corresponding to the other risk nodes, a matching value is obtained.

[0135] Understandably, adding a pre-screening step before calculating complex matching values ​​can significantly improve the efficiency of the entire detection system.

[0136] For example, different features are first selected to characterize the key features of node behavior, such as traffic features, connection features, target features, protocol features, etc.

[0137] The algorithm is fed a large amount of historical normal behavior data (feature vectors) of the nodes. The algorithm learns the normal distribution area of ​​this data in the feature space. Since all the data is normal, the algorithm considers points falling outside the dense area to be isolated, i.e., anomalous. For example, unsupervised anomaly detection models, such as Isolation Forest and other related publicly available algorithms, can be used, and this application is not limited to them.

[0138] Based on historical data, a historical baseline model can be constructed for each network node. The current behavior data is then input into the historical baseline model, and the deviation score output by the historical baseline model is obtained. The historical baseline model is used to output the predicted deviation score based on the input running data. The deviation score is used to characterize the degree of deviation between the input running data and multiple historical behavior data. Finally, a preset deviation threshold is obtained. If the deviation score is greater than the preset deviation threshold, the corresponding network node is determined to be a risk node.

[0139] Understandably, another set of known historical data containing both normal and some abnormal behaviors is used to test the model's performance. This assesses its ability to accurately identify known anomalies without generating false positives for normal behavior. Based on the business's tolerance for false positives and false negatives, a threshold is set to trigger alerts for risk nodes. A high threshold results in fewer alerts but potentially more false negatives; a low threshold results in more alerts but potentially more false positives.

[0140] Building a historical baseline model essentially involves creating a personalized, quantifiable description of "normal behavior habits" for each network node. By comparing a node's current behavior with its own "habits," we can efficiently and accurately filter out individuals with "abnormal behavior" from a massive number of nodes, providing high-quality candidate targets for subsequent, more refined collaboration analysis, thereby greatly improving the efficiency and accuracy of the entire detection process.

[0141] S103: If multiple identical matching values ​​exist, then multiple corresponding network nodes are determined to form a network node group.

[0142] Understandably, "same" here does not refer to absolute mathematical equality, but rather a high degree of consistency or clustering within a very small margin of error. For example, if node AB has a matching value of 0.92, node AC has a matching value of 0.91, and node BC has a matching value of 0.92, we can consider them to have the same high matching value.

[0143] Understandably, nodes in a botnet, controlled by the same source and executing the same malware, exhibit very similar behavioral patterns (i.e., similarity in sequence, statistics, and structure). This similarity manifests numerically as highly concentrated match values. In contrast, the match values ​​between normal nodes, or anomalous nodes not belonging to the same botnet, appear random and dispersed.

[0144] For example, suppose there are 6 nodes (A, B, C, D, E, F). After cluster analysis, the pairwise matching value matrix between them shows that:

[0145] Group 1: Nodes A, B, and C form a tight cluster. AB=0.95, AC=0.94, BC=0.96. Their matching values ​​are consistently high.

[0146] Group 2: Nodes D and E form another cluster. DE=0.93.

[0147] Isolated point: Node F has a very low match value with all other nodes (e.g., 0.1).

[0148] Then the system will determine:

[0149] Network node group 1 = {A, B, C}

[0150] Network node group 2 = {D, E}

[0151] Understandably, a group of multiple nodes with a high degree of internal coordination is far more likely to be a botnet than a single node exhibiting abnormal behavior. This significantly reduces the false positive rate.

[0152] S104: Identify zombie network nodes based on network node groups.

[0153] For example, if the current behavior data of a network node belonging to a network node group is consistent with the historical behavior data corresponding to at least N consecutive historical periods, then the risk node belonging to the risk node group is determined to be a zombie network node, where N is an integer greater than 2.

[0154] Understandably, for example, several servers might simultaneously generate high traffic due to a temporary system update task. This behavior might last for 1-2 cycles, but it wouldn't repeat the same collaborative pattern indefinitely. However, botnet collaboration, because the bot programs are continuously controlled by the C&C server, will exhibit stable and repeatable patterns of collaborative activity as long as the control channel exists.

[0155] For example, suppose the system is set to a unit duration of 5 minutes and the judgment threshold N=3.

[0156] Period T0 (current period): The system analyzes the data and finds that nodes {A, B, C} form a risk node group (with highly consistent matching values). At this point, the system will not make a judgment immediately, but will instead initiate backtracking verification.

[0157] Backtracking verification:

[0158] The system retrieved data from period T-1 (5 minutes ago) and, after analysis, found that nodes {A,B,C} also formed a cooperative group at that time.

[0159] The system continued to retrieve data from period T-2 (10 minutes ago), and after analysis, it confirmed once again that nodes {A,B,C} also constituted a cooperative group.

[0160] Understandably, this ensures that only those groups of nodes exhibiting stable, repeatable malicious behavior are ultimately flagged, effectively filtering out the vast majority of legitimate or accidental collaborative activities.

[0161] This invention proposes a botnet detection method that achieves efficient and accurate botnet identification through the following steps: First, it collects the current behavior data of each network node within a unit of time. Next, it quantifies the degree of collaboration in three dimensions—temporal synchronization, behavioral similarity, and communication graph structure—by calculating the matching value of the behavioral data between nodes. When multiple nodes have the same matching value, they are identified as a network node group. Finally, by verifying the consistency of the behavior of this node group over multiple consecutive historical periods, the botnet node is confirmed. This botnet detection method, employing multi-dimensional collaborative analysis combined with a historical persistence verification mechanism, effectively overcomes the limitations of traditional single-node detection, significantly improves detection accuracy, and greatly reduces the false alarm rate, making it suitable for real-time security protection in large-scale network environments.

[0162] Based on the same inventive concept, this application also proposes a botnet detection system, which is configured as follows:

[0163] Obtain multiple current behavior data of multiple network nodes in the current running cycle, where the duration of the current running cycle is in units of time;

[0164] Based on the current behavior data corresponding to each network node, a matching value is obtained with the current behavior data corresponding to the other network nodes. The matching value is used to characterize the degree of synergy of multiple current behavior data in terms of temporal and statistical features.

[0165] If multiple identical matching values ​​exist, then multiple corresponding network nodes are identified as forming a risk node group;

[0166] Zombie network nodes are identified based on network node groups.

[0167] In some implementations, the system is configured as follows:

[0168] Based on the current behavior data corresponding to each network node, a matching value is obtained with the current behavior data corresponding to the remaining network nodes. This matching value characterizes the degree of synergy among multiple current behavior data sets in terms of temporal and statistical features, including:

[0169] Acquire historical data for each network node. The historical data includes multiple historical behavior data corresponding to historical periods of multiple unit durations.

[0170] Based on each current behavior data and its corresponding historical data, multiple risk nodes are identified from multiple network nodes;

[0171] Based on the current behavior data corresponding to each risk node, a matching value is obtained with the current behavior data corresponding to the other risk nodes.

[0172] In some implementations, the system is configured to identify multiple risk nodes from multiple network nodes based on each current behavior data and its corresponding historical data, including:

[0173] Based on historical data, construct a historical baseline model for each network node;

[0174] The current behavior data is fed into the historical baseline model, and the deviation score output by the historical baseline model is obtained. The historical baseline model is used to output the predicted deviation score based on the input running data. The deviation score is used to characterize the degree of deviation between the input running data and multiple historical behavior data.

[0175] Obtain a preset deviation threshold. If the deviation score is greater than the preset deviation threshold, the corresponding network node is determined to be a risk node.

[0176] In some implementations, the system is configured as follows:

[0177] Based on the current behavior data corresponding to each network node, a matching value is obtained with the current behavior data corresponding to the remaining network nodes. This matching value characterizes the degree of synergy among multiple current behavior data sets in terms of temporal and statistical features, including:

[0178] Obtain the temporal synchronization coordination degree corresponding to the first dimension;

[0179] Obtain the behavioral similarity synergy corresponding to the second dimension;

[0180] Obtain the structural synergy degree of the communication graph corresponding to the third dimension;

[0181] Matching values ​​are determined based on temporal synchronization coordination, behavioral similarity coordination, and communication graph structural coordination.

[0182] In some implementations, the system is configured as follows:

[0183] Obtain the temporal synchronization coordination degree corresponding to the first dimension, including:

[0184] Transform the continuous behavioral data in the current behavioral data into an abnormal event sequence and obtain the corresponding timestamps;

[0185] For any two current behavior data with abnormal event sequences, if the two current behavior data have the same abnormal time sequence within a sliding time window, it is recorded as an overlap, and the corresponding network node is a suspicious node.

[0186] Calculate the number of overlaps in the abnormal time series between all pairs of suspicious nodes, and determine the temporal synchronization degree based on the number of overlaps.

[0187] In some implementations, the system is configured as follows:

[0188] Obtain the behavioral similarity synergy corresponding to the second dimension, including:

[0189] Obtain the behavior feature vector for each current behavior data. The behavior feature vector includes: average data packet size sent, connection duration, and target port entropy value.

[0190] A similarity matrix is ​​constructed based on all behavioral feature vectors, and the clustering profile coefficients corresponding to the similarity matrix are obtained. The clustering profile coefficients are then used as the similarity synergy.

[0191] In some implementations, the system is configured as follows:

[0192] Obtain the structural synergy degree of the communication graph corresponding to the third dimension, including:

[0193] Network connection data is obtained based on current behavior data, and a target communication bipartite graph between network nodes and external nodes is constructed based on the network connection data;

[0194] Obtain the graph centrality index of external nodes in the target communication bipartite graph;

[0195] Based on the graph centrality index, the structural synergy of the communication graph is determined.

[0196] In conjunction with the second aspect, in some implementations, the system is configured as follows:

[0197] Zombie network nodes are identified based on network node groups, including:

[0198] If the current behavior data of a network node belonging to a network node group is consistent with the historical behavior data corresponding to at least N consecutive historical periods, then the risk node belonging to the risk node group is determined to be a zombie network node, where N is an integer greater than 2.

[0199] This invention proposes a botnet detection system that achieves efficient and accurate botnet identification through the following steps: First, it collects the current behavior data of each network node within a unit of time. Next, it quantifies the degree of collaboration in three dimensions—temporal synchronization, behavioral similarity, and communication graph structure—by calculating the matching value of the behavioral data between nodes. When multiple nodes have the same matching value, they are identified as a network node group. Finally, by verifying the consistency of the behavior of this node group over multiple consecutive historical periods, the botnet node is confirmed. This botnet detection system, employing multi-dimensional collaborative analysis combined with a historical continuous verification mechanism, effectively overcomes the limitations of traditional single-node detection, significantly improves detection accuracy, and greatly reduces the false alarm rate, making it suitable for real-time security protection in large-scale network environments.

[0200] Based on the same inventive concept, embodiments of this application also propose an electronic device, which includes:

[0201] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the botnet detection method of the embodiments of this application.

[0202] Furthermore, to achieve the above objectives, embodiments of this application also propose a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the botnet detection method of embodiments of this application.

[0203] The following is a detailed introduction to the various components of the electronic device:

[0204] In this context, the processor is the control center of the electronic device. It can be a single processor or a collective term for multiple processing elements. For example, a processor can be one or more central processing units (CPUs), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0205] Alternatively, the processor can perform various functions of the electronic device by running or executing software programs stored in memory and by calling data stored in memory.

[0206] The memory is used to store the software program that executes the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can be referred to the above method embodiment, which will not be repeated here.

[0207] Optionally, the memory can be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory can be integrated with the processor or exist independently and coupled to the processor through an interface circuit of an electronic device; the embodiments of the present invention do not specifically limit this.

[0208] A transceiver is used to communicate with network devices or with terminal devices.

[0209] Optionally, the transceiver may include a receiver and a transmitter. The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0210] Optionally, the transceiver can be integrated with the processor or exist independently and coupled to the processor through the router's interface circuit. This embodiment of the invention does not specifically limit this.

[0211] Furthermore, the technical effects of the electronic device can be referred to the technical effects of the data transmission method in the above method embodiments, and will not be repeated here.

[0212] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0213] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DRRAM).

[0214] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0215] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0216] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0217] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0218] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

Claims

1. A method for detecting botnets, characterized in that, include: Obtain multiple current behavior data of multiple network nodes in the current running cycle, wherein the duration of the current running cycle is a unit duration; Acquire historical data corresponding to each network node, wherein the historical data includes multiple historical behavior data corresponding to multiple historical periods of multiple unit durations; Based on historical data, construct a historical baseline model for each network node; Substitute the current behavior data into the historical baseline model and obtain the deviation score output by the historical baseline model. The historical baseline model is used to output the predicted deviation score based on the input running data. The deviation score is used to characterize the degree of deviation between the input running data and multiple historical behavior data. Obtain a preset deviation threshold. If the deviation score is greater than the preset deviation threshold, then determine the corresponding network node as a risk node. Based on the current behavior data corresponding to each risk node, a matching value is obtained with the current behavior data corresponding to the other risk nodes; wherein, the matching value is used to characterize the degree of synergy of the multiple current behavior data in terms of temporal and statistical features; Obtain the temporal synchronization coordination degree corresponding to the first dimension; Obtain the behavioral similarity synergy corresponding to the second dimension; Obtain the structural synergy degree of the communication graph corresponding to the third dimension; The matching value is determined based on the temporal synchronization coordination degree, behavioral similarity coordination degree, and communication graph structural coordination degree. If multiple identical matching values ​​exist, then multiple corresponding network nodes are determined to constitute a network node group; Zombie network nodes are determined based on the network node group. If the current behavior data of the network node belonging to the network node group is consistent with the historical behavior data corresponding to at least N consecutive historical periods, then the risk node belonging to the risk node group is determined to be a zombie network node, where N is an integer greater than 2.

2. The botnet detection method according to claim 1, characterized in that, Obtain the behavioral similarity synergy corresponding to the second dimension, including: Obtain the behavior feature vector for each of the current behavior data, the behavior feature vector including: average data packet size sent, connection duration, and target port entropy value; A similarity matrix is ​​constructed based on all the behavioral feature vectors, and the clustering contour coefficients corresponding to the similarity matrix are obtained. The clustering contour coefficients are then used as the similarity synergy.

3. A botnet detection method according to claim 1, characterized in that, Obtain the structural synergy degree of the communication graph corresponding to the third dimension, including: Based on the current behavior data, network connection data is obtained, and based on the network connection data, a target communication bipartite graph between the network node and external nodes is constructed; Obtain the graph centrality index of the external nodes in the target communication bipartite graph; Based on the graph centrality index, the structural synergy of the communication graph is determined.

4. An electronic device, characterized in that, include: At least one processor; And, a memory communicatively connected to at least one of the processors; The memory stores instructions that can be executed by at least one of the processors, which are executed by at least one of the processors to enable at least one of the processors to perform a botnet detection method as claimed in any one of claims 1-3.

Images