Botnets’ similarity analysis based on communication features and D-S evidence theory

ZANG Tian-ning1; YUN Xiao-chun1; ZHANG Yong-zheng2; MEN Chao-guang1; CUI Xiang2

您当前的位置：

首页 >

文章列表页 >

Botnets’ similarity analysis based on communication features and D-S evidence theory

更新时间：2024-10-14

- Botnets’ similarity analysis based on communication features and D-S evidence theory
- Vol. 32, Issue 4, Pages: 66-76(2011)
- 作者机构：
  
  1. 哈尔滨工程大学计算机科学与技术学院
  2. 中国科学院计算技术研究所
  3. 信息内容安全技术国家工程实验室
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393.08
- Published：2011
- 稿件说明：
移动端阅览
ZANG Tian-ning1, YUN Xiao-chun1, ZHANG Yong-zheng2, et al. Botnets’ similarity analysis based on communication features and D-S evidence theory[J]. 2011, 32(4): 66-76.
DOI：

ZANG Tian-ning1, YUN Xiao-chun1, ZHANG Yong-zheng2, et al. Botnets’ similarity analysis based on communication features and D-S evidence theory[J]. 2011, 32(4): 66-76. DOI：

摘要

不同僵尸网络之间可能具有潜在的隐藏关系

根据僵尸网络通信行为提出分析僵尸网络之间关系的方法

提取僵尸网络内部通信的数据流数量、流中数据分组数量、主机通信量和数据分组负载等特征

并定义特征相似度统计函数

通过改进D-S证据理论

建立分析僵尸网络之间关系的模型

综合评判两批僵尸主机群相似度。经过典型样本评测

验证了该方法的良好分析效果

且可弱化加密通信的影响。分析了基础网络安全监测平台捕获的僵尸网络数据

并与相关工作比较

突出了该方法的技术先进性。

Abstract

A potential hidden relationship may exist among different zombie groups.A method to analyze the relationship among botnets was proposed based on the communication activities.The method extracted several communication fea-tures of botnet

including the number of flows per hour

the number of packets per flow

the number of flows per IP and the packet payloads.It defined similarity statistical functions of the communication features

and built the analysis model of botnets relationship based on the advanced dempster-shafer（D-S） evidence theory to synthetically evaluate the simi-larities between different zombie groups.The experiments were conducted using several botnet traces.The results show that the method is valid and efficient

even in the case of encrypted botnet communication messages.Moreover

the ideal processing results is achieved by applying our method to analyze the data captured from the security monitoring platform of computer network

as well as compare with similar work.

关键词

Keywords

references

Views

966

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Strong measurement method of evidence conflict based on earth mover’s distance

Botnet detection based on generative adversarial network

Heterogeneous executor scheduling algorithm for mimic cloud service

Evidence combination method based on Pignistic function transformation and correlation coefficient

BotCatcher:botnet detection system based on deep learning

Related Author

Wei FU

Xin WANG

Yongkang JIANG

Lin WANG

Yue TAN

Futai ZOU

Kai WANG

Ruihao DING

Related Institution

Key Laboratory of Information Fusion Estimation and Detection in Heilongjiang Province

Department of Automation, Heilongjiang University

School of Cyber Science and Engineering, Shanghai Jiao Tong University

Information Engineering University

College of Communication Engineering, Jilin University

AI问答

⁰