动态僵尸网络模型研究

Research of dynamic Botnet model

现有的僵尸网络技术和检测方法通常局限于某种特定的僵尸网络。为提高僵尸网络的隐秘性,提出了一种动态僵尸网络模型,利用有向图进行描述,可以表示不同类型的僵尸网络。对模型的暴露性、可恢复性和可持续性等动态属性进行量化分析,给出了一种僵尸主机主动丢弃原则。实验结果表明,提出的方法可以有效降低僵尸网络检测率,提高僵尸网络的可持续性和可恢复性。

The existing Botnet techniques and detection methods are usually confined to specific Botnet.To improve the confidentiality of Botnet,the authors proposed a dynamic Botnet model described with directed graph,which can accommodate various Botnets.Several dynamic attributes of the proposed model were analyzed,such as exposedness,resilience,sustainability in detail,and then a bot abandon policy was presented.The experimental results indicate that the proposed method can decrease the Botnet＇s detection ratio and improve sustainability and resilience effectively.