一种基于超球面嵌入的僵尸网络检测方法、装置及设备

By combining hyperspherical embedding and Extreme Learning Machine (ELM) classifier, high-precision classification of botnet traffic is achieved, solving the problem of insufficient accuracy of botnet detection in complex encryption scenarios in existing technologies, and improving the real-time performance and intelligence level of network security protection.

CN121193478BActive Publication Date: 2026-07-17SOUTHEAST UNIV +1
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
SOUTHEAST UNIV
Filing Date
2025-09-18
Publication Date
2026-07-17

AI Technical Summary

Technical Problem

Existing DDoS detection methods struggle to achieve high-precision classification in complex encryption scenarios and lack the ability to distinguish between different botnet families, resulting in a lack of initiative and foresight in network protection systems.

Method used

A botnet detection method based on hyperspherical embedding is adopted. By acquiring traffic feature vectors and mapping them to a unit spherical space, the method is classified by combining an Extreme Learning Machine (ELM) classifier. The botnet family prototype vectors are extracted by spherical clustering and von Mises-Fisher hybrid model, and a geometric representation of high-dimensional features and label correspondence is constructed.

Benefits of technology

It improves the accuracy and real-time performance of botnet family classification, enhances the ability to detect unknown or variant botnets in complex environments, and improves the refinement and intelligence of the network security protection system.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121193478B_ABST
    Figure CN121193478B_ABST
Patent Text Reader

Abstract

本发明公开了一种基于超球面嵌入的僵尸网络检测方法、装置及设备,通过获取待检测流量数据,对待检测流量数据进行流量特征提取,并构建待检测流量数据的流量特征向量,生成球面嵌入向量;将球面嵌入向量输入经训练好的极限学习机ELM分类器,输出待检测流量所属的僵尸网络家族分类。本发明实现对待检测流量数据的高维特征在球面空间上的几何化表达,使得不同僵尸网络家族在嵌入空间中具有更清晰的分布差异,结合极限学习机ELM分类器的快速训练与推理优势,不仅提高了僵尸网络家族分类的准确率和实时性,还增强了对复杂环境下未知或变种僵尸网络的检测和泛化能力,从而显著提升网络安全防护体系的精细化与智能化水平。
Need to check novelty before this filing date? Find Prior Art

Citation Information

Patent Citations

  • Botnet recognition method based on extreme learning machine

    CN111224998A

  • Botnet detection method and system based on feature selection and feature fusion

    CN119324809A