基于内容关联推荐的HTTP僵尸网络检测算法

HTTP Botnet Detection Algorithm Based on Content Association Recommendations

HTTP协议的僵尸网络分布广泛,危害巨大。传统的检测方法要等到攻击行为发生之后再分析攻击数据流。为了进一步降低僵尸网络的危害性,基于HTTP协议的僵尸网络特点,设计了一种基于内容关联推荐的在线检测方法。该方法能够区分正常数据和恶意数据,并能够在攻击发生之前完成检测,在不增加网络负担的情况下完成在线检测,实验证明了此方法的可行性。

HTTP botnet is widely distributed and very harmful. The traditional detection method can’t analyze the attack data stream until the attack stops. For further reducing the harm,and according to the botnet characteristics of HTTP protocol,an online detection method which is based on content association recommendations is designed in this article. This method is able to distinguish between normal data and malicious data,and complete detection before the attack starts,without increasing the burden of the network because of small complexity. The method is proved to be feasible from the experiment.