基于异常DNS流量的僵尸网络活动检测
Detecting Botnet Activities Based on Abnormal DNS traffic
摘要：
僵尸网络由于其快速增长的机制和影响而被认为是互联网的一个关键问题。最近，僵尸网络已经像任何合法主机一样利用DNS和查询DNS服务器。在这种情况下，很难区分合法DNS流量和非法DNS流量。因此，构建一个合适的解决方案来检测DNS流量中的僵尸网络，从而保护网络免受恶意僵尸网络活动的影响是非常重要的。本文提出了一种简单的机制来监测DNS流量，并检测僵尸网络发出的异常DNS流量的基础上，僵尸网络出现的一组主机周期性的事实。该机制还能够对主机群（群体行为）和单个主机（个体行为）请求的DNS流量进行分类，从而检测出恶意僵尸网络发出的异常域名。实验结果表明，该机制具有较好的鲁棒性，能够对DNS流量进行分类，并能有效检测僵尸网络活动，平均检测率达到89%。
英文摘要：
IThe botnet is considered as a critical issue of the Internet due to its fast growing mechanism and affect. Recently, Botnets have utilized the DNS and query DNS server just like any legitimate hosts. In this case, it is difficult to distinguish between the legitimate DNS traffic and illegitimate DNS traffic. It is important to build a suitable solution for botnet detection in the DNS traffic and consequently protect the network from the malicious Botnets activities. In this paper, a simple mechanism is proposed to monitors the DNS traffic and detects the abnormal DNS traffic issued by the botnet based on the fact that botnets appear as a group of hosts periodically. The proposed mechanism is also able to classify the DNS traffic requested by group of hosts (group behavior) and single hosts (individual behavior), consequently detect the abnormal domain name issued by the malicious Botnets. Finally, the experimental results proved that the proposed mechanism is robust and able to classify DNS traffic, and efficiently detects the botnet activity with average detection rate of 89 percent.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
