科研之友
微信
新浪微博
Facebook
分享链接
摘要
Peer-to-peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high-speed Internet Service Provider and enterprise networks are challenging for these network-based systems, which performcomputationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high-speed networks as soon as possible, and then samples as many botnet-related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine-grained detectors for further in-depth analysis. We evaluate our system using traffic datasets of real-world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet-related packets in the sampled packetswhile maintain the high detection accuracy of the fine-grained detectors.
- 出版日期2017-10
- 单位中国人民解放军国防科学技术大学
