关键词: 僵尸网络,贝叶斯,MapReduce,流量,Hadoop 中图法分类号TP393文献标识码A

Abstract: Although botnets are detected in a more accurate way by using Bayesian algorithm,it has the character of large flow and the training of Bayesian classification needs to train a large number of network datasets．Therefore,it will lead to meet a bottleneck of calculation of the time and resources by using a single node to detect the botnets．To this end,this paper designed a Bayesian algorithm based on the MapReduce to parallely process the calculation of the prior probability and the conditional probability in the training phase,and the posterior probability in the detection phase of Bayesian algorithm．A large number of experiments running on Hadoop platform show that this method improves the efficiency of bonnets detecting.

Key words: Botnets,Bayesian,MapReduce,Flow,Hadoop