僵尸网络检测方法研究

Research on Detecting Botnets

僵尸网络是指由黑客通过多种传播手段入侵并控制的主机组成的网络。僵尸网络是各种恶意软件传播和控制的主要来源,检测僵尸网络对于网络安全非常重要。本文首先介绍了僵尸网络的结构,着重对僵尸网络的命令与控制信道进行了讨论,接着详细介绍了基于主机信息的、基于流量监测的和基于对等网络的僵尸网络检测方法,并进行了比较和讨论。

A botnet is a network of compromised machines that can be remotely controlled to perform illegitimate network activities. In this paper, we introduce the structure of botnets, and focus on the command and control channel, which is important for detecting botnets. We then make a review and discussion on current schemes on detecting botnets.