检测网络中的僵尸网络
Detecting a botnet in a network
摘要：
我们正式检测僵尸网络在网络中的存在的问题作为一个假设检验问题，我们观察到一个单一的图形实例。对应于僵尸网络不存在的原假设被建模为随机几何图，其中每个顶点被分配在$d$维环面上的位置，并且当两个顶点的距离小于某个阈值时，两个顶点被连接。备择假设与此类似，只是有一小部分顶点（称为僵尸网络）忽略了这种几何结构，只是以规定的概率随机连接到其他每个顶点。我们提出了两个测试，能够检测到这样的僵尸网络的存在。第一个测试是基于僵尸网络顶点倾向于形成在原假设下不存在的大型孤立星的想法。第二个检验使用平均图距离，在备择假设下，平均图距离显著缩短。我们表明，这两个测试是渐近最优的。然而，数值模拟表明，孤立星测试性能显着优于平均距离测试的中等规模的网络。最后，我们构建了一个强大的计划的基础上孤立星测试，也能够识别僵尸网络中的顶点。
英文摘要：
We formalize the problem of detecting the presence of a botnet in a network as an hypothesis testing problem where we observe a single instance of a graph. The null hypothesis, corresponding to the absence of a botnet, is modeled as a random geometric graph where every vertex is assigned a location on a $d$-dimensional torus and two vertices are connected when their distance is smaller than a certain threshold. The alternative hypothesis is similar, except that there is a small number of vertices, called the botnet, that ignore this geometric structure and simply connect randomly to every other vertex with a prescribed probability. We present two tests that are able to detect the presence of such a botnet. The first test is based on the idea that botnet vertices tend to form large isolated stars that are not present under the null hypothesis. The second test uses the average graph distance, which becomes significantly shorter under the alternative hypothesis. We show that both these tests are asymptotically optimal. However, numerical simulations show that the isolated star test performs significantly better than the average distance test on networks of moderate size. Finally, we construct a robust scheme based on the isolated star test that is also able to identify the vertices in the botnet.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
