僵尸网络为平台的攻击发展迅速,当前大多数的检测方法是通过分析历史网络流量信息来发现特定协议的僵尸网络,难以满足实时需要,且不能通用。针对这种情况,提出了一种独立于控制协议与结构的僵尸网络在线检测技术,能够从网络流量数据中快速检测出可疑僵尸主机。模拟实验结果表明,该技术能够高效地实现僵尸网络在线检测。
Botnet-based attacking is becoming one of the most serious threats on the Internet.Lots of approaches have been proposed to detect the presence of botnet.However,most of them just focus on offline detection methods by tracking the historical network traffic,which is not suitable for real-time and general detection.In this paper,we propose a new technique that can detect the botnet activities in an online fashion,which is also independent of the botnet structure.The experimental evaluations show that this approach can achieve online botnet detection efficiently.