arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 1503.02337cs.SIphysics.soc-ph
收藏

基于社会图分析的僵尸网络检测

Botnet Detection using Social Graph Analysis

Jing Wang, Ioannis Ch. Paschalidis

摘要:

基于签名的僵尸网络检测方法通过识别命令和控制(C\&C)流量来识别僵尸网络,并且对于使用新的和可扩展的机制进行此类通信的僵尸网络可能无效。为了解决这些局限性,我们提出了一种新的僵尸网络检测方法,分析节点之间的社会关系。该方法由两个阶段组成:(i)在节点之间的“交互”图中使用度分布上的大偏差结果进行异常检测,以及(ii)在社交“相关”图中进行社区发现,该社交“相关”图的边缘连接具有高度相关通信的节点。后一阶段使用了一个精致的模块化措施,并制定了一个非凸优化问题,为适当的松弛策略的问题。我们将我们的方法应用于现实世界的僵尸网络流量,并将其性能与其他社区发现方法进行比较。实验结果表明,该方法是有效的,改进的模块性度量提高了检测精度。

英文摘要:

Signature-based botnet detection methods identify botnets by recognizing Command and Control (C\&C) traffic and can be ineffective for botnets that use new and sophisticate mechanisms for such communications. To address these limitations, we propose a novel botnet detection method that analyzes the social relationships among nodes. The method consists of two stages: (i) anomaly detection in an "interaction" graph among nodes using large deviations results on the degree distribution, and (ii) community detection in a social "correlation" graph whose edges connect nodes with highly correlated communications. The latter stage uses a refined modularity measure and formulates the problem as a non-convex optimization problem for which appropriate relaxation strategies are developed. We apply our method to real-world botnet traffic and compare its performance with other community detection methods. The results show that our approach works effectively and the refined modularity measure improves the detection accuracy.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑