基于通信流量特征的隐秘P2P僵尸网络检测

针对目前基于网络的P2P僵尸网络检测中特征建模不完善、不深入的问题, 以及僵尸网络中通信具有隐蔽性的特点, 提出一种对通信流量特征进行聚类分析的检测方法。分析P2P僵尸网络在潜伏阶段的通信流量统计特征, 使用结合主成分分析法和X-means聚类算法的两阶段聚类方法对特征数据集进行聚类分析, 进而达到检测P2P僵尸网络的目的。实验结果表明, 该方法具有较高的检测率和较好的识别准确性, 并保证了较快的执行效率。

Detecting stealthy P2P botnets based on communication traffic characteristics

Aiming at the problems that feature modeling was deficient and unthorough in network-based P2P botnet detection, and the characteristic that communication in botnet was elusive, this paper proposed a detecting method based on communication traffic characteristics. Firstly, it analyzed the communication traffic characteristics of P2P botnets in latency. Secondly, it used two-stages clustering algorithm which combined principal components analysis and X-means clustering algorithm to cluster flow attributes set, so as to achieve the purpose of detecting P2P botnets. Experimental results show that the method has a higher detection rate and better recognition accuracy, ensuring faster execution efficiency at the same time.