通过日志相关检测僵尸网络
Detecting Botnets Through Log Correlation
摘要：
僵尸网络由数千台受感染的机器组成，可以通过发起分布式拒绝服务（SSoS）攻击、键盘记录和后门对其他系统造成重大威胁。为了应对这些威胁，需要新的有效技术来检测僵尸网络的存在。在本文中，我们已经使用了拦截技术来监视Windows应用程序编程接口（API）函数调用的通信应用程序，并存储这些调用与他们的参数在日志文件。我们的算法通过关联来自不同主机的日志文件大小的变化来监控异常活动，从而检测僵尸网络。
英文摘要：
Botnets, which consist of thousands of compromised machines, can cause significant threats to other systems by launching Distributed Denial of Service (SSoS) attacks, keylogging, and backdoors. In response to these threats, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface (API) functions calls made by communication applications and store these calls with their arguments in log files. Our algorithm detects botnets based on monitoring abnormal activity by correlating the changes in log file sizes from different hosts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
