基于僵尸网络流量特征的深度学习检测

僵尸网络作为一种新型攻击方式,如今已成为互联网安全领域面临的重大威胁。随着计算机网络的发展,僵尸网络逐渐从传统的基于IRC协议向基于HTTP协议转变。海量的HTTP数据流使得僵尸网络可以有效的隐藏自身,这给僵尸网络的检测和识别增加了难度。通过分析HTTP网络流量,获取僵尸网络流量特征,提出将深度学习应用于僵尸网络检测的方法。实验结果显示,该方法可以有效地、准确地从HTTP流量中检测僵尸网络。     

基于MapReduce的僵尸网络在线检测算法

目前僵尸网络主要是通过网络流量分析的方法来进行检测,这往往依赖于僵尸主机的恶意行为,或者需要外部系统提供信息。另外传统的流量分析方法计算量很大,难以满足实时要求。为此该文提出一种基于MapReduce的僵尸网络在线检测算法,该算法通过分析网络流量并提取其内在的关联关系检测僵尸网络,并在云计算平台上进行数据分析,使数据获取和数据分析工作同步进行,实现在线检测。实验结果表明该算法的检测率可达到90%以上,误报率在5%以下,并且数据量较大时加速比接近线性,验证了云计算技术在僵尸网络检测方面的可行性。     

基于OpenFlow与sFlow的DDoS攻击防御方法

分布式拒绝服务(DDoS)攻击是目前比较流行的网络攻击,其破坏力大并且难以防范追踪,对互联网安全造成了极大的威胁。针对此问题提出了一种基于OpenFlow与sFlow的入侵检测方法,通过sFlow采样技术实时检测网络流量,依据网络正常流量设定流量阈值,并通过对超过阈值的异常流量进行攻击检测、判断攻击流,最终使用OpenFlow协议阻断攻击源。该方法可以在几秒内自动检测、处理多种DDoS攻击。实验结果表明,与现有方案对比,该方法能够实时检测并阻止DDoS攻击,有效降低网络资源消耗。     

僵尸网络检测研究

僵尸网络是一种严重威胁网络安全的攻击平台。文章先给出僵尸网络的定义,然后分析其工作机制,命令与控制机制。针对当前主流的僵尸网络检测方法,按照不同的行为特征进行分类,根据僵尸网络的静态特征、动态特征以及混合特征,对当前的主要检测方法进行了归纳、分析和总结。并在文章最后提出,建立一个完备的僵尸网络检测模型需要将僵尸网络的动态特征检测模型与静态特征检测模型相互结合,而这才是僵尸网络检测模型未来发展的重点。     

基于多维流量特征的IRC僵尸网络频道检测

针对IRC僵尸网络频道的检测问题,提出一种基于流量特征的检测方法。分析了僵尸网络频道数据流在不同周期内流量的聚类性、相似性、平均分组长度、流量高峰和协同流量高峰等特征,并以此作为僵尸网络频道检测的依据。检测过程中,采用改进的最大最小距离和k-means聚类分析算法,改善了数据聚类的效果。最后经过实验测试,验证了方法的有效性。     

一种基于相似度的DDoS攻击检测方法

在分析了网络流量构成的基础上,提出了基于相似度的DDoS检测方法。这种方法不是简单的根据流量的突变来检测网络状况,而是从分析攻击对流量分布的影响着手。首先对网络流量进行高频统计,然后对其相邻时刻进行相似度分析,根据相似度的变化来发现异常。从大量的实验结果可以看出基于相似度的检测方法能够比较有效的发现大流量背景下,攻击流量并没有引起整个网络流量显著变化的DDoS攻击,因此更适合大规模网络的异常检测。     

基于平衡迭代规约层次聚类的无线传感器网络流量异常检测方案

针对现有网络流量异常检测方法不适用于实时无线传感器网络(WSN)检测环境、缺乏合理异常判决机制的问题,该文提出一种基于平衡迭代规约层次聚类(BIRCH)的WSN流量异常检测方案.该方案在扩充流量特征维度的基础上,利用BIRCH算法对流量特征进行聚类,通过设计动态簇阈值和邻居簇序号优化BIRCH聚类过程,以提高算法的聚类...     

基于序列特征的网络流分类方法研究

如今,对网络流量中各种应用进行准确分类和识别已经变得越来越重要,针对目前流量分析研究的不足,本文综合国内外相关研究成果,提出了在双向动态网络流模型的基础上,采用细粒度的Packet-Level序列特征属性对流量进行分析,建立序列特征属性与网络流类型之间的关联关系,实现了一种高效的、与端口无关的网络流分类方法.     

基于机器学习的物联网异常流量检测方法

随着物联网的广泛应用,物联网的安全问题受到越来越多的关注.针对物联网环境下异常网络流量问题,提出了基于机器学习的物联网异常流量检测方法.首先通过使用聚类算法分析物联网一段时间内网络数据的特征,然后使用连续假设检验算法对特征进行分类,并对恶意流量的空间分布进行二次特征分析.实验表明,相对于传统的异常流量检测方法,该检测方...     

网络入侵后的波动控制系统设计与实现

网络入侵具有较强的破坏以及不可控性,受到入侵攻击后的网络流量存在冲突、约束数据带宽等随机因素,使得网络流量产生波动,稳定性降低。以往网络波动控制方法,在网络波动性高于设置的阈值后,控制方法不能对网络波动进行有效控制。因此,基于自抗扰控制器,设计并实现网络波动控制系统,该系统包括流量采集模块、流量汇总模块、流量异常检测和控制模块以及警示模块,并且具备网络探析部件、主机探析部件、策略管理中心、控制台四大功能。系统采用自抗扰处理器对入侵攻击产生的流量波动进行控制,确保网络流量的均衡性。实验结果表明,所提方法下的网络入侵行为显著降低,具有较低的网络入侵性能。     

Analysis on the time-domain characteristics of botnets control traffic

Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol(IP) addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol(DHCP),so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can’t be always online.The whole process is carried out under the command and control(C&C) channel.Our goal is to characterize the network traffic under the C&C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider(ISP) Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection(DPI) Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C&C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection(DFI) technology.     

基于信誉度的移动自组网入侵检测分簇算法

针对已有基于路由的分簇算法,不适用于移动自组网入侵检测的特性要求,文中提出了一种基于信誉度的入侵检测分簇算法(CIDS).该算法从簇结构安全、稳定的角度出发,采用信誉度的概念对网络节点属性进行数学抽象,定义了节点信誉度的数学表达式,选择综合信誉度高的节点收集网络教据、检测网络行为.为移动自组网入侵检测系统提供了稳定、安全的支持.     

Particle Swarm Optimization Algorithm Based Artificial Neural Network for Botnet Detection

A standout amongst the most dangers to the cyber security is known as Botnet since it offers a conveyed stage for many undesirable activities. From the network traffic flow, the identification of Botnet is a fundamental test. Artificial Neural Network–Particle Swarm Optimization (ANN–PSO) based botnet discovery is proposed in this paper. In this paper, ISCX dataset is utilized for botnet location. The features are classified as botnet flow and normal flow by giving the features separated from the dataset as a contribution to the grouping. For grouping, we have displayed ANN–PSO which lessens the false classification ratio and time multifaceted nature to 3.3% and 14 s. We contrast our proposed work with other existing work and demonstrate that our work is superior to anything that of alternate works in the simulation results.

     

Adaptive traffic sampling for P2P botnet detection

Peer‐to‐peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high‐speed Internet Service Provider and enterprise networks are challenging for these network‐based systems, which perform computationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high‐speed networks as soon as possible, and then samples as many botnet‐related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine‐grained detectors for further in‐depth analysis. We evaluate our system using traffic datasets of real‐world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet‐related packets in the sampled packets while maintain the high detection accuracy of the fine‐grained detectors.     

BotCatcher:botnet detection system based on deep learning

Machine learning technology has wide application in botnet detection.However,with the changes of the forms and command and control mechanisms of botnets,selecting features manually becomes increasingly difficult.To solve this problem,a botnet detection system called BotCatcher based on deep learning was proposed.It automatically extracted features from time and space dimension,and established classifier through multiple neural network constructions.BotCatcher does not depend on any prior knowledge which about the protocol and the topology,and works without manually selecting features.The experimental results show that the proposed model has good performance in botnet detection and has ability to accurately identify botnet traffic .     

基于深度学习的域名查询行为向量空间嵌入

提出一种新的分析DNS查询行为的方法,用深度学习机制将被查询域名和请求查询的主机分别映射到向量空间,域名或主机的关联分析转化成向量的运算。通过对2组真实的校园网DNS日志数据集的处理,发现该方法很好地保持了关联特性,使用降维处理以及聚类分析,不仅可以让人直观地发现隐含的关联关系,还有助于发现网络中的异常问题如botnet等。     

A self‐learning stream classifier for flow‐based botnet detection

Botnets have been recently recognized as one of the most formidable threats on the Internet. Different approaches have been designed to detect these types of attacks. However, as botnets evolve their behavior to mislead the signature‐based detection systems, learning‐based methods may be deployed to provide a generalization capacity in identifying unknown botnets. Developing an adaptable botnet detection system, which incrementally evolves with the incoming flow stream, remains as a challenge. In this paper, a self‐learning botnet detection system is proposed, which uses an adaptable classification model. The system uses an ensemble classifier and, in order to enhance its generalization capacity, updates its model continuously on receiving new unlabeled traffic flows. The system is evaluated with a comprehensive data set, which contains a wide variety of botnets. The experiments demonstrate that the proposed system can successfully adapt in a dynamic environment where new botnet types are observed during the system operation. We also compare the system performance with other methods.     

僵尸网络的类型、危害及防范措施

作为一种危害性极强的新型攻击手段,僵尸网络逐步成为互联网最严重的威胁之一。僵尸网络不是一种单一的网络攻击行为,而是一种网络攻击的平台和其他传统网络攻击手段的综合。介绍了僵尸网络的分类及危害,提出了僵尸网络的应对方法与措施,并对僵尸网络的发展进行了探讨。     

基于决策树的僵尸流量检测方法研究

僵尸网络目前是互联网面临的安全威胁之一,检测网络中潜在的僵尸网络流量对提高互联网安全性具有重要意义。论文重点研究了基于IRC协议的僵尸网络,以僵尸主机与聊天服务器之间的会话特征为基础,提出了一种基于决策树的僵尸网络流量检测方法。实验证明该方法是可行的。     

基于投票法的密度峰聚类算法

密度峰聚类(DPC)算法采用点的密度与距离属性对数据进行划分。该算法对大多数数据集能获得较好的聚类结果。然而，对于存在交叉、重叠情况的数据集，DPC算法的最近邻居分配方法将造成较大误差。针对这一缺陷，本文考虑到数据点的大部分邻居属于相同的簇，提出一种多邻居投票的聚类方法。该方法采取多个邻居的投票结果来决定未知点的归属。数值实验表明，基于投票法的密度峰聚类算法在面对点分布存在交叉、重叠情况的数据集时优于DPC算法。