使用蜜罐命令日志上的自然语言处理技术识别僵尸网络IP地址集群
Identifying botnet IP address clusters using natural language processing techniques on honeypot command logs
摘要：
计算机安全一直受到越来越多的强大的，动态的，难以检测，难以预测和难以表征的黑客技术的困扰。这些技术通常部署在自我传播的蠕虫中，能够自动感染易受攻击的计算机系统，然后构建大型僵尸网络，然后用于对指定目标发动协调攻击。在这项工作中，我们研究了新的应用程序的自然语言处理（NLP）的方法来检测和相关的僵尸网络行为，通过分析蜜罐数据。在我们的方法中，我们采取观察到的行为在外壳命令发出的入侵者在捕获的互联网会话，并减少他们的随机过程的集合，反过来，处理与机器学习技术，以建立分类器和预测。我们的技术结果在集群僵尸网络源IP地址的新能力，即使在面对他们的愿望，通过快速或随机排列技术混淆他们的渗透企图。
英文摘要：
Computer security has been plagued by increasing formidable, dynamic, hard-to-detect, hard-to-predict, and hard-to-characterize hacking techniques. Such techniques are very often deployed in self-propagating worms capable of automatically infecting vulnerable computer systems and then building large bot networks, which are then used to launch coordinated attacks on designated targets. In this work, we investigate novel applications of Natural Language Processing (NLP) methods to detect and correlate botnet behaviors through the analysis of honeypot data. In our approach we take observed behaviors in shell commands issued by intruders during captured internet sessions and reduce them to collections of stochastic processes that are, in turn, processed with machine learning techniques to build classifiers and predictors. Our technique results in a new ability to cluster botnet source IP address even in the face of their desire to obfuscate their penetration attempts through rapid or random permutation techniques.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
