通信学报 ›› 2018, Vol. 39 ›› Issue (8): 18-28.doi: 10.11959/j.issn.1000-436x.2018135

• 论文Ⅰ:人工智能与网络安全 • 上一篇    下一篇

BotCatcher:基于深度学习的僵尸网络检测系统

吴迪1,2,方滨兴3,4,5,崔翔1,3(),刘奇旭1,2   

  1. 1 中国科学院信息工程研究所,北京 100093
    2 中国科学院大学网络空间安全学院,北京 100049
    3 广州大学网络空间先进技术研究院,广东 广州 510006
    4 电子科技大学广东电子信息工程研究院,广东 东莞 523808
    5 北京邮电大学网络空间安全学院,北京 100876
  • 修回日期:2018-07-10 出版日期:2018-08-01 发布日期:2018-09-13
  • 作者简介:吴迪(1991-),男,辽宁抚顺人,中国科学院大学博士生,主要研究方向为网络攻防技术。|方滨兴(1960-),男,江西万年人,中国工程院院士,北京邮电大学教授、博士生导师,主要研究方向为计算机体系结构、计算机网络与信息安全。|崔翔(1978-),男,黑龙江讷河人,博士,广州大学研究员,主要研究方向为网络攻防技术。|刘奇旭(1984-),男,江苏徐州人,博士,中国科学院副研究员、中国科学院大学副教授,主要研究方向为网络攻防技术、网络安全评测。
  • 基金资助:
    国家重点研发计划基金资助项目(2016YFB0801604);东莞市引进创新科研团队计划基金资助项目(201636000100038);中国科学院网络测评技术重点实验室和网络安全防护技术北京市重点实验室基金资助项目

BotCatcher:botnet detection system based on deep learning

Di WU1,2,Binxing FANG3,4,5,Xiang CUI1,3(),Qixu LIU1,2   

  1. 1 Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China
    2 School of Cyber Security,University of Chinese Academy of Sciences,Beijing 100049,China
    3 Cyberspace Institute of Advanced Technology,Guangzhou University,Guangzhou 510006,China
    4 Institute of Electronic and Information Engineering of UESTC in Guangdong,Dongguan 523808,China
    5 School of Cyberspace Security,Beijing University of Posts and Telecommunications,Beijing 100876,China
  • Revised:2018-07-10 Online:2018-08-01 Published:2018-09-13
  • Supported by:
    The National Key Research and Development Program of China(2016YFB0801604);Dongguan Innovative Research Team Program(201636000100038);The Key Laboratory of Network Assessment Technology at Chinese Academy of Sciences and Beijing Key Laboratory of Network Security and Protection Technology

摘要:

机器学习技术在僵尸网络检测领域具有广泛应用,但随着僵尸网络形态和命令控制机制逐渐变化,人工特征选取变得越来越困难。为此,提出基于深度学习的僵尸网络检测系统——BotCatcher,从时间和空间这 2 个维度自动化提取网络流量特征,通过结合多种深层神经网络结构建立分类器。BotCatcher不依赖于任何有关协议和拓扑的先验知识,不需要人工选取特征。实验结果表明,该模型性能良好,能够对僵尸网络流量进行准确识别。

关键词: 僵尸网络, 深度学习, 检测, 特征

Abstract:

Machine learning technology has wide application in botnet detection.However,with the changes of the forms and command and control mechanisms of botnets,selecting features manually becomes increasingly difficult.To solve this problem,a botnet detection system called BotCatcher based on deep learning was proposed.It automatically extracted features from time and space dimension,and established classifier through multiple neural network constructions.BotCatcher does not depend on any prior knowledge which about the protocol and the topology,and works without manually selecting features.The experimental results show that the proposed model has good performance in botnet detection and has ability to accurately identify botnet traffic .

Key words: botnet, deep learning, detection, feature

中图分类号: 

No Suggested Reading articles found!