僵尸网络关系云模型分析算法

通过分析僵尸网络内部的通信行为,提取了相同僵尸网络的通信特征,利用这些特征定义了僵尸网络之间关系的云模型,并设计了基于云模型的僵尸网络关系分析算法。通过典型僵尸程序样本的评测结果表明,即使对采用加密通信和无固定通信时间间隔的僵尸程序,该算法仍然能够有效地识别出这些僵尸网络之间的关系。通过与相关研究工作的对比表明,该算法在分析的准确度、僵尸网络的类型和加密通信等方面均优于相关研究成果。

A Botnet Relationship Analyzer Based on Cloud Model

An approach for analyzing the relationship among botnets was presented.Several botnet communication characteristics were extracted,including the amount of data flows within a botnet,the number of packets per data flow,the payload of communication and data packets in the master hosts.Statistical similarity functions of botnet characteristics were defined.Based on the cloud model and the defined statistical similarity functions,the analysis model of botnet relationship was build,and the similarities of botnet characteristics were synthetically evaluated.The analysis experiments were conducted based on a simulation network environment.The experimental results show that the presented method was valid and efficient,even in the case of encrypted botnet communication messages.The result is better than the research production in the report on the interrelated research achievements.