基于多维流量特征的IRC僵尸网络频道检测

doi:10.3969/j.issn.1000-436x.2013.10.006

通信学报 ›› 2013, Vol. 34 ›› Issue (10): 49-55.doi: 10.3969/j.issn.1000-436x.2013.10.006

基于多维流量特征的IRC僵尸网络频道检测

闫健恩¹,袁春阳²(),许海燕¹,张兆心¹

¹ 哈尔滨工业大学计算机科学与技术学院，黑龙江哈尔滨150001
² 国家计算机网络应急技术处理协调中心，北京100029

出版日期:2013-10-25 发布日期:2017-08-10
基金资助:
国家高技术研究发展计划(“863”计划)基金资助项目;国家自然科学基金资助项目;国家自然科学基金资助项目;国家科技支撑计划基金资助项目;山东省中青年科学家奖励基金资助项目;威海市科技攻关基金资助项目;哈尔滨工业大学科研创新基金资助项目

Method of detecting IRC Botnet based on the multi-features of traffic flow

Jian-en YAN¹,Chun-yang YUAN²(),Hai-yan XU¹,Zhao-xin ZHANG¹

¹ School of Computer Science and Technology,Harbin Institute of Technology,Harbin 150001,China
² National Computer Network Emergency Response Technical Team/Coordination Center of China,Beijing 100029,China

Online:2013-10-25 Published:2017-08-10
Supported by:
The National High Technology Research and Development Program of China (863 Program);The National Natural Science Foundation of China;The National Natural Science Foundation of China;The National Science and Technology Support Pro-gram;Young and Middle-Aged Scientists Research Awards Fund of Shandong Province;Weihai Municipal Science and Technology Research;Harbin Institute of Technology Scientific Research Innovation Founda-tion

摘要/Abstract

摘要：

针对IRC僵尸网络频道的检测问题，提出一种基于流量特征的检测方法。分析了僵尸网络频道数据流在不同周期内流量的聚类性、相似性、平均分组长度、流量高峰和协同流量高峰等特征，并以此作为僵尸网络频道检测的依据。检测过程中，采用改进的最大最小距离和k-means聚类分析算法，改善了数据聚类的效果。最后经过实验测试，验证了方法的有效性。

关键词: IRC协议, 僵尸网络, 数据流, 聚类分析

Abstract:

To resolve the problem of detecting IRC Botnet,a method based on traffic flow characteristics was proposed.The characteristics of Botnet channel traf?cwere analyzed in different periods such as data-clustering,data-similarity,the average length of packet,peak of synchronized traf?c,and peak of collaborative synchronized traf?c,and these characteristics were used to detect the botnet.In analyzing,improved max-min distance means and k-means cluster analysis algorithm were also presented to promote the efficiency of data clustering.At last,the availability of the method was verified by experiment.

Key words: IRC protocol, Botnet, raffic flow, cluster analysis

闫健恩,袁春阳,许海燕,张兆心. 基于多维流量特征的IRC僵尸网络频道检测[J]. 通信学报, 2013, 34(10): 49-55.

Jian-en YAN,Chun-yang YUAN,Hai-yan XU,Zhao-xin ZHANG. Method of detecting IRC Botnet based on the multi-features of traffic flow[J]. Journal on Communications, 2013, 34(10): 49-55.

图/表 12

表1

表2

表3

表4

图1

图2

图3

图4

图5

图6

图7

表5

参考文献 15

[1]	诸葛建伟, 韩心慧, 周勇林 ,等. 僵尸网络研究[J]. 软件学报, 2008(3): 702-715. ZHUGE J W , HAN X H , ZHOU Y L ,et al. Research and development of Botnets[J]. Journal of Software, 2008(3): 702-715.
[2]	CNCERT/CC互联网安全威胁报告[EB/OL]. .CNCERT/CC Internet security threat report[EB/OL]. .
[3]	江健, 诸葛建伟, 段海新 ,等. 僵尸网络机理与防御技术[J]. 软件学报, 2012,23(1): 82-96. JIANG J , ZHUGE J W , DUAN X H ,et al. Research on Botnet mechanisms and defenses[J]. Journal of Software, 2012,23(1): 82-96.
[4]	FEDYNYSHYN G , CHUAH M , TAN G . Detection and classification of different Botnet C＆C channels[A]. Proceedings of the 8th Interna-tional Conference[C]. Banff,Canada, 2011. 228-242.
[5]	BINKLEY J R , SINGH S . An algorithm for anomaly-based Botnet detection[A]. Proceedings of the 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet[C]. Berkeley,CA,USA, 2006. 43-48.
[6]	TSAI M H , CHANG K C , LIN C C ,et al. C＆C tracer:Botnet command and control behavior tracing[A]. Proceedings of the 2011 IEEE International Conference on Systems,Man and Cybernetics (SMC)[C]. Anchorage,AK, 2011. 1859-1864.
[7]	GIROIRE F , CHANDRASHEKAR J , TAFT N ,et al. Exploiting temporal persistence to detect covert botnet channels[A]. Proceedings of the Recent Advances in Intrusion Detection[C]. Springer Berlin Heidelberg,Brittany,France, 2009. 326-345.
[8]	LU C , BROOKS R . Botnet traffic detection using hidden models[A]. Proceedings of the Seventh Annual Workshop Cyber Security and Information Intelligence Research[C]. Oak Ridge,TN,USA, 2011.31
[9]	BREZO F , SANTOS I , BRINGAS P G ,et al. Challenges and limita-tions in current botnet detection[A]. Proceedings of the 22nd Interna-tional Workshop on Database and Expert Systems Applications (DEXA)[C]. Toulouse, 2011. 95-101.
[10]	HUA J , SAKURAI K . Botnet command ＆ control based on sh message service and human mobility[J]. Computer Networks, 2012(57): 579-597.
[11]	AKIYAMA M , KAWAMOTO T , SHIMAMURA M ,et al. A proposal of metrics for Botnet detection based on its cooperative behavior[A]. Proceedings of Applications and the Internet Workshops[C]. Hiroshi-ma,Japan, 2007.82.
[12]	王爽 . 基于流量特征的 IRC 僵尸网络检测技术研究[D]. 哈尔滨 :哈尔滨工业大学, 2008. WANG S . Research of IRC Botnet Detection Technology Based on Traffic Flow Characteristics[D]. Harbin:Harbin Institute of Technolo-gy, 2008.
[13]	孙吉贵, 刘杰, 赵连宇 . 聚类算法研究[J]. 软件学报, 2008,19(1): 48-61. SUN J G , LIU J , ZHAO L Y . Clustering algorithms research[J]. Journal of Software, 2008,19(1): 48-61.
[14]	HANSEN P , NGAI E , CHEUNG B K ,et al. Analysis of global k-means,an incremental heuristic for minimum sum-of-squares clus-tering[J]. Journal of Classification, 2005,22(2): 287-310.
[15]	陈德军, 罗金成, 张兵 . 基于改进的k-means聚类算法的分类评价方法[J]. 武汉理工大学学报, 2011,33(1): 32-35. CHEN D J , LUO J C , ZHANG B . Classification and evaluation on reviewers based on improved -means clustering algorithm[J]. Journalk of WUT(Information ＆ Management Engineering), 2011,33(1): 32-35.

编号	所属频道
s₅,s₆	botnet1
s₇,s₈	botnet2
s₁,s₂	botnet3
s₄	normal2
s₃	控制者主机数据流

聚类类别编号	k-mean算法数据流编号	改进的k-mean算法数据流编号
class1	s₅,s₈	s₅,s₆
class2	s₁,s₂	s₁,s₂
class3	s₃	s₃
class4	s₆,s₇	s₇,s₈
class5	s₄	s₄

编号	s₁	s₂	s₃	s₄	s₅	s₆	s₇	s₈
s₁	—	5 554.40	2 899 120.04	17 354 190.63	19 095 778.52	19 078 586.52	19 016 386.65	19 017 606.65
s₂	5 554.40	—	2 911 296.54	17 915 036.63	19 293 992.65	19 309 982.65	192 324 068.65	19 232 928.65
s₃	2 899 120.04	2 911 296.54	—	31 671 884.74	34 331 848.79	34 310 488.79	33 582 316.77	33 584 500.77
s₄	17 354 190.63	17 915 036.63	31 671 884.74	—	312 306.91	308 995.25	419 095.17	418 329.45
s₅	19 095 778.52	19 293 992.65	34 331 848.79	312 306.91	—	2 153.04	18 689 563.71	18 685 582.71
s₆	19 078 586.52	19 309 982.65	34 310 488.79	308 995.25	2 153.04	—	18 701 250.06	18 710 147.12
s₇	19 016 386.65	192 324 068.65	33 582 316.77	419 095.17	18 689 563.71	18 701 250.06	—	682.02
s₈	19 017 606.65	19 232 928.65	33 584 500.77	418 329.45	18 685 582.71	18 710 147.12	682.02	—

编号	平均数据分组长度
s₁	104.53
s₂	104.81
s₃	95.53
s₄	80.67
s₅	66.89
s₆	66.76
s₇	77.49
s₈	77.80

编号	特征值
s₁	0.9
s₂	0.9
s₃	0.5
s₄	0
s₅	0.6
s₆	0.6
s₇	0.7
s₈	0.7

基于多维流量特征的IRC僵尸网络频道检测

Method of detecting IRC Botnet based on the multi-features of traffic flow

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 12

参考文献 15

相关文章 15

Metrics

推荐阅读 0

[1]	哈冠雄, 贾巧雯, 陈杭, 贾春福. 无第三方服务器的基于数据流行度的加密去重方案[J]. 通信学报, 2022, 43(8): 17-29.
[2]	李骜, 冯聪, 牛宇童, 徐士彪, 张英涛, 孙广路. 面向视角非对齐数据的多视角聚类方法[J]. 通信学报, 2022, 43(7): 143-152.
[3]	邹福泰, 谭越, 王林, 蒋永康. 基于生成对抗网络的僵尸网络检测[J]. 通信学报, 2021, 42(7): 95-106.
[4]	谢绒娜,郭云川,李凤华,史国振,王亚琼,耿魁. 面向数据跨域流转的延伸访问控制机制[J]. 通信学报, 2019, 40(7): 67-76.
[5]	刘伟,熊曙,杜薇,王伟. 移动云环境中数据流应用的Cloudlet选择策略研究[J]. 通信学报, 2019, 40(1): 87-101.
[6]	吴迪,方滨兴,崔翔,刘奇旭. BotCatcher：基于深度学习的僵尸网络检测系统[J]. 通信学报, 2018, 39(8): 18-28.
[7]	李莉,史国振,耿魁,董秀则,李凤华. 基于负载均衡的随机作业流密码服务调度算法[J]. 通信学报, 2018, 39(6): 11-19.
[8]	迟荣华,程媛,朱素霞,黄少滨,陈德运. 基于快速高斯变换的不确定数据聚类算法[J]. 通信学报, 2017, 38(3): 101-111.
[9]	赵春晖,李雪源,崔颖. 混合编码方式的图像聚类算法[J]. 通信学报, 2017, 38(2): 1-9.
[10]	尤涛,李廷峰,杜承烈,钟冬,朱怡安. 基于规则前件发生树匹配的数据流预测方法研究[J]. 通信学报, 2017, 38(12): 98-108.
[11]	尹涛,李世淙,庹宇鹏,张永铮. 强抗毁性社交僵尸网络的构建及其防御[J]. 通信学报, 2017, 38(1): 97-105.
[12]	李可,方滨兴,崔翔,刘奇旭,严志涛. 基于Webshell的僵尸网络研究[J]. 通信学报, 2016, 37(6): 11-19.
[13]	唐麒,吴尚峰,施峻武,魏急波. 基于图分割的流应用多处理器映射算法[J]. 通信学报, 2016, 37(6): 137-143.
[14]	陈乃金,冯志勇,江建慧. 用于二维RCA跨层数据传输的旁节点无冗余添加算法[J]. 通信学报, 2015, 36(4): 35-51.
[15]	周爱平，程光，郭晓军，朱琛刚. 长持续时间数据流的并行检测算法[J]. 通信学报, 2015, 36(11): 156-166.