基于终端行为特征的IRC僵尸网络检测

IRC Botnet Detection Based on Host Behavior

目前已有的IRC僵尸网络检测算法存在两个问题:需要先验知识以获取匹配模式,无法满足实时处理需求.为解决这两个问题,文中提出了基于昵称和命令序列这两个终端行为特征的IRC僵尸网络检测算法.文中提出三种属性分别从内容、组成和结构三方面互补的刻画两个昵称的相似性,给出两个昵称相似性的量化因子,根据这量化因子生成弹性TRW算法以进行IRC僵尸网络实时检测.文中还在分析僵尸终端登录服务器的行为的基础上,提出了基于命令序列相似性的检测算法.算法评估实验证明两个算法行之有效.最后将这两个算法用于大规模网络环境中实时检测IRC僵尸网络,在两周内检测到162个僵尸频道.

There are two problems in current algorithms for IRC botnets detection. One is that detection algorithms require some prior knowledge of botnets to generate matching patterns. The other is that algorithms can not perform detection online. To solve these problems, this paper proposes two IRC botnet detection algorithms based on host behavior. Three attributes, LCS rate, compositive distance and RN_dice coefficient, are discussed to quantify the similarity of nicknames from three aspects： content, composition and structure. To detect IRC hornets on- line, extended TRW algorithm based on the similarity of nicknames is proposed. This paper also proposes a detection algorithm based on the command sequence of IRC clients. Evaluations of these algorithms indicate that the two algorithms are correct and valid. At last, detection algo- rithms are used in large-scale network to detect IRC botnets and detect 162 bot channels within two weeks.