僵尸网络已经成为当前网络中的主要安全威胁之一,特别是P2P僵尸网络的发展,使得僵尸网络的生存能力大大提高。针对P2P僵尸网络提出了一种僵尸网络防御模型FLBDM,该模型分为检测、分析、反制3个部分。首先,基于模糊逻辑理论,提出了僵尸网络检测模型FLDBM;其次,引入蜜罐网络对僵尸程序进行分析;最后,引入认证僵尸网络对原僵尸网络进行反制。仿真实验表明:与CU—SUM相比,FLBDM防御模型有着良好的检测成功率,以及较低的误报率,并能有效地对僵尸网络进行破坏。
The problem of botnet, especially in the P2P context which makes the botnet have stronger abilities in survival, has become one of the major threats for network security. A fuzzy logic botnet defense model (FLBDM) was developed to deal with the problem which is made up of three components, detection, analysis, and counterattack. A logic detection model, FLDBM (fuzzy logic detect botnet model), was proposed based on the fuzzy logic theory, with the typical botnet procedures then analyzed by introducing honeypot network. The authentication botnet was used to counterattack. Both simulations and experiments demonstrate that FLBDM has high successful detection rates with low false alarming rates while effectively destroying botnets.