Abstract:

At present,the botnet detection method mostly relies on the analysis of the network communication activity or the communication content.The former carries on the statistical analysis to the characteristic of the data flow,does not involve the content in the data flow,has the strong superiority in the detection encryption type aspect,but the accuracy is low.The latter relies on the prior knowledge to examine,has the strong accuracy,but the generality of detection is low.The communication similarity was defined according to Jaccard similarity coefficient,and a method of calculating communication similarity based on user request DNS (domain name system) was proposed,which was used for botnet node detection based on network traffic.Finally,based on the spark framework,the experimental results show that the proposed method can be used in the detection of botnet nodes effectively.

Key words: botnet, similarity detection, DNS flow detection, network security