僵尸云和正常云服务2种环境下的基本网络流特征差异不明显,导致传统的基于网络流特征分析法在检测僵尸云问题上失效。为此,研究利用深度学习技术解决僵尸云检测问题。首先,从网络流中提取基本特征;然后将其映射为灰度图像;最后利用卷积神经网络算法进行特征学习,提取出更加抽象的特征,用以表达网络流数据中隐藏的模式及结构关系,进而用于检测僵尸云。实验结果表明,该方法不仅能够提高检测的准确度,而且能减少检测所用时间。
The differences of the basic network flow characteristics between BotCloud and normal cloud services were not obvious, and this led to the inefficiency of the method in BotCloud detection based on network flow characteristics analysis. To solve this problem, a CNN(convolution neural network)-based method for detecting the BotCloud was pro- posed. First, it extracted the basic network flow characteristics from network flow data packets. Second, it mapped the basic network flow characteristics into gray image. Finally, in order to detect BotCloud, it utilized CNN algorithm to learn and extract characteristics that were more abstract to express the hidden model and structural relationship in the network data flow. The experimental results show that the proposed method can not only enhance the accuracy of detection, but also greatly reduce the time required for detecting.