大规模网络流量下的恶意地址检测技术研究

Research on Malicious Address Detection Technology in Large Scale Network Traffic

针对网络流量增长迅速,传统的检测方法很难解决恶意地址检测的问题,在介绍传统的恶意地址检测方法以及这些方法遇到的问题的基础上,提出了一种新的恶意地址检测思路,依靠恶意地址本身的语义特性和词汇特性建立地址分类模型,并给出模型的实现方法。通过实验测试4 389 763个地址,检测出地址3 292 322个,恶意地址834个,漏报率25%,检测时间3.21 min。由于不需要加载外部资源,处理速度相对传统检测方法有质的提高,能够适应大规模网络流量下的恶意地址检测。

In view of the rapid growth of network traffic, the traditional detection method is difficult to solve the problem of malicious address detection. On the basis of introducing the traditional method of detecting malicious address and the problems encountered in these methods, proposed a new idea of malicious address detection, that build a address classification model based on semantic features and lexical features of the malicious address, and given the realization method of the model. Tested 4 389 763 addresses by experiment, detected address 3 292 322, malicious address 834, the false negative rate of 25~, detection time 3.21 rain. Because it does not need to load external resources, the processing speed is improved by the traditional method. Can Be able to adapt to the large scale network traffic under the malicious address detection.