基于异常行为特征的僵尸网络检测方法研究

基于僵尸网络通信及网络流量的异常行为，可以有效检测出僵尸频道。介绍了通过对主机响应信息的异常分析，进而判断出当前IRC频道是否为一个僵尸频道的检测算法。由此引入了基于异常行为的僵尸频道检测模型，该模型分类提取IRC频道的主机响应信息，结合检测算法分析得出结论。实验结果验证了该模型的有效性。

Abnormal Behavior-Based Botnet Detection Algorithm

The zombie network communications and network traffic based abnormal behavior can detect the botnet channel effectively.This paper describes an algorithm which can determine whether the current IRC channel is a botnet channel or not through the analysis of the information on the response.The Anomaly-based detection model about the botnet channel is introduced,which extracts the information on the response and draws a conclusion by the testing algorithm.The experimental results verify the validity of the mod...