僵尸网络的检测与防范策略

Detecting and Defendable Policy of Botnet

僵尸网络是各种恶意软件传播和控制的主要来源,检测僵尸网络对于网络安全非常重要。介绍了僵尸网络的概念、类型以及危害,论述基于IRC协议以及P2P控制方式的检测方法,提出了防范措施。

The Botnet is a one-to-many control network which is composed of controller and infected hosts, and the attacker uses one or more broadcasting methods to make a lot of hosts infected.h is primarily coming from various malicious softwares that were casted and controled, and is very important for network security to detect botnet. In this paper, the concept, types and threat of it were introduced, then detecting method was described,based on the controling mode through IRC and P2P protocol, finnally the measure was given to avoid it.