计算机科学 ›› 2025, Vol. 52 ›› Issue (11): 373-381.doi: 10.11896/jsjkx.241100019
张海霞1, 黄克振1, 连一峰1, 赵昌志2, 袁云静1, 彭媛媛1
ZHANG Haixia1, HUANG Kezhen1, LIAN Yifeng1, ZHAO Changzhi2, YUAN Yunjing1, PENG Yuanyuan1
摘要： 随着信息技术的飞速发展,僵尸网络攻击已成为具有高危害程度的网络安全威胁,及时有效的僵尸网络检测和处置可以遏制攻击者利用僵尸网络发起其他衍生攻击。当前已有的僵尸网络检测方法存在因特征选取视角单一而易被攻击者绕过、误报率高等局限性。对此,提出一种基于多粒度统计特征的僵尸网络流量智能检测方法,该方法提取待检测网络流量的局部粗粒度统计特征和面向源IP的全局细粒度画像,进而利用具有多头注意力机制的长短期记忆网络挖掘良性网络流量与僵尸网络流量在两类统计特征方面存在的差异性,最终基于这些差异性识别僵尸网络流量。在CTU-13和ISCX僵尸网络数据集上进行了对比实验,该方法在准确率、精确率、召回率和F1分数均可达到99%以上。
中图分类号:
| [1]Office of Public Affairs.Qakbot Malware Disrupted in International Cyber Takedown[EB/OL].https://www.justice.gov/opa/pr/qakbot-malware-disrupted-international-cyber-takedown. [2]MAHMOUD M,NIR M,MATRAWY A.A survey on botnet architectures,detection and defences[J].International Journal of Network Security,2015,17(3):264-281. [3]BEER F,BÜHLER U.Feature selection for flow-based intru-sion detection using rough set theory[C]//2017 IEEE 14th International Conference on Networking,Sensing and Control(ICNSC).IEEE,2017:617-624. [4]CLAISE B.Cisco systems netflow services export version 9[R].2004. [5]KONDO S,SATO N.Botnet traffic detection techniques byC&C session classification using SVM[C]//International Workshop on Security.Berlin:Springer,2007:91-104. [6]AYO F E,AWOTUNDE J B,FOLORUNSO S O,et al.A genomic rule-basedKNN model for fast flux botnet detection[J].Egyptian Informatics Journal,2023,24(2):313-325. [7]ALHIJAJ T B,HAMEED S M,BARA'A A A.A decision tree-aware genetic algorithm for botnet detection[J].Iraqi Journal of Science,2021,62(7):2454-2462. [8]HOANG X D,VUX H.An improved model for detecting DGAbotnets using random forest algorithm[J].Information Security Journal:A Global Perspective,2022,31(4):441-450. [9]ZANG X,CAO J,ZHANG X,et al.BotDetector:a system foridentifying DGA-based botnet with CNN-LSTM[J].Telecommunication Systems,2023,85(2):207-223. [10]ABOU DAYA A,SALAHUDDIN M A,LIMAM N,et al.A graph-based machine learning approach for bot detection[C]//2019 IFIP/IEEE Symposium on Integrated Network and Service Management(IM).IEEE,2019:144-152. [11]UMER M F,SHER M,BI Y.Flow-based intrusion detection:Techniques and challenges[J].Computers & Security,2017,70:238-254. [12]THASEEN S,KUMAR C A.An analysis of supervised treebased classifiers for intrusion detection system[C]//2013 International Conference on Pattern Recognition,Informatics and Mobile Engineering.IEEE,2013:294-299. [13]HEGNA A.Visualizing spatial and temporal dynamics of a class of irc-based botnets[EB/OL].https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262293/353050_FULLTEXT.01pdf?sequence=2&isAllowed=y. [14]GARCIA S,GRILL M,STIBOREK J,et al.An empirical comparison of botnet detection methods[J].Computers & Security,2014,45:100-123. [15]HOCHREITER S,SCHMIDHUBER J.Long short-term memory[J].Neural Computation,1997,9(8):1735-1780. [16]ZHANG A,LIPTON Z C,LI M,et al.Dive into deep learning[M].Cambridge:Cambridge University Press,2023. [17]VASWANI A,SHAZEER N,PARMAR N,et al.Attention isall you need[C]//Proceedings of the 31st International Confe-rence on Neural Information Processing Systems.2017:6000-6010. [18]GARCÍA S.Identifying,modeling and detecting botnet beha-viors in the network[EB/OL].https://www.stratosphereips.org/publications/2014/12/5/identifying-modeling-and-detec-ting-botnet-behaviors-in-the-network. [19]BEIGI E B,JAZI H H,STAKHANOVA N,et al.Towards effective feature selection in machine learning-based botnet detection approaches[C]//2014 IEEE Conference on Communications and Network Security.2014. [20]ZOU F T,TAN Y,WANG L,et al.Botnet detection based on generative adversarial network[J].Journal on Communications,2021,42(7):95-106. [21]SRINARAYANI K,PADMAVATHI B,KAVITHA D.Detec-tion of Botnet Traffic using Deep Learning Approach[C]//2023 International Conference on Sustainable Computing and Data Communication Systems(ICSCDS).IEEE,2023:201-206. |
|
||
首页