摘要
IRC僵尸网络(botnet)是攻击者通过IRC服务器构建命令与控制信道方式控制大量主机(bot)组成的网络.IRC僵尸网络中IRC服务器与bot连接具有很强的动态特性,为识别使用不同IRC服务器的同一僵尸网络,文中提取并比对僵尸网络的通信量特征、通信频率特征,建模估算bot重叠率,通过融合以上度量指标,提出了僵尸网络相似性度量模型.实验验证了模型的有效性,计算了其准确率,并分析了僵尸网络的迁移.
IRC botnet can be regarded as a collection of compromised computers（called Zombie computers）running software under the command-and-control infrastructure constructed by the IRC servers.The connection between the botnet server and the bots are usually very dynamic.In order to describe a botnet at a finer granularity,the paper proposes a method that measures the similarity of botnets by extracting and comparing the metrics such as communication volumes,frequency,and the overlap rate of bots.A novel model for botnet similarity measuring is proposed by combining those metrics mentioned. Experiments are carried out for validation ses,the confidence of the accuracy is evaluated and shown, and the migration situation of are also discussed. purpobotnet
出处
《计算机学报》
EI
CSCD
北大核心
2010年第1期45-54,共10页
Chinese Journal of Computers
基金
国家"八六三"高技术研究发展计划项目基金(2007AA010502
2007AA01Z474
2006AA01Z451)资助~~
关键词
僵尸网络
通信
聚集
相似性度量
迁移
botnet
communication
assemble
similarity measure
migration
