蒋天宇1,
张小松1, 2,,,
谢娇1,
张俊哲3,
赵振扉1
1.电子科技大学计算机科学与工程学院/网络空间安全研究院 成都 611731
2.鹏城实验室网络空间安全研究中心 深圳 518040
3.四川大学网络空间安全学院 成都 610065
基金项目:国家重点研发计划(2016QY06X1205, 2018YFB0804050)，国家自然科学基金(61572115)
详细信息
作者简介:牛伟纳：女，1990年生，博士，讲师，研究方向为网络安全、软件安全、AI在网络安全安全中的应用
蒋天宇：男，1995年生，硕士生，研究方向为网络安全、网络攻击检测
张小松：男，1968年生，博士，教授，研究方向为大数据应用及安全、人工智能的应用与安全、移动计算安全、网络攻击的追踪溯源
谢娇：女，1996年生，硕士生，研究方向为网络安全、网络攻击检测
赵振扉：男，1991年生，硕士生，研究方向为网络安全、网络攻击检测
通讯作者:张小松 johnsonzxs@uestc.edu.cn
中图分类号:TP309计量
文章访问数:1391
HTML全文浏览量:1323
PDF下载量:54
被引次数:0
出版历程
收稿日期:2019-09-19
修回日期:2020-04-18
网络出版日期:2020-05-12
刊出日期:2020-08-18
Fast-flux Botnet Detection Method Based on Spatiotemporal Feature of Network Traffic
Weina NIU1,Tianyu JIANG1,
Xiaosong ZHANG1, 2,,,
Jiao XIE1,
Junzhe ZHANG3,
Zhenfei ZHAO1
1. Institute for Cyber Security, School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China
2. Cyberspace Security Research Center, Peng Cheng Laboratory, Shenzhen 518040, China
3. College of Cybersecurity, Sichuan University, Chengdu 610065, China
Funds:The National Key Research and Development Program of China (2016QY06X1205, 2018YFB0804050), The National Natural Science Foundation of China (61572115)
摘要
摘要:僵尸网络已成为网络空间安全的主要威胁之一，虽然目前可通过逆向工程等技术来对其进行检测，但是使用了诸如fast-flux等隐蔽技术的僵尸网络可以绕过现有的安全检测并继续存活。现有的fast-flux僵尸网络检测方法主要分为主动和被动两种，前者会造成较大的网络负载，后者存在特征值提取繁琐的问题。因此为了有效检测fast-flux僵尸网络并解决传统检测方法中存在的问题，该文结合卷积神经网络和循环神经网络，提出了基于流量时空特征的fast-flux僵尸网络检测方法。结合CTU-13和ISOT公开数据集的实验结果表明，该文所提检测方法和其他方法相比，准确率提升至98.3%，召回率提升至96.7%，精确度提升至97.5%。
关键词:僵尸网络/
Fast-flux/
卷积神经网络/
循环神经网络
Abstract:Botnets have become one of the main threats to cyberspace security. Although they can be detected by techniques such as reverse engineering, botnets using covert technologies such as fast-flux can successfully bypass existing security detection and continue to survive. The existing fast-flux botnet detection methods are mainly divided into active and passive, the former will cause a large network load, and the latter has the problem of cumbersome feature value extraction. In order to effectively detect fast-flux botnets and alleviate the problems in traditional detection methods, a fast-flux botnet detection method based on spatiotemporal features of network traffic is proposed, combined with convolutional neural networks and recurrent neural network models, the fast-flux botnet is detected from both spatial and temporal dimensions. Experiments performed on the CTU-13 and ISOT public data sets show that compared with other methods, the accuracy rate of the proposed method is 98.3%, the recall rate is 96.7%, and the accuracy is 97.5%.
Key words:Botnet/
Fast-flux/
Convolutional Neural Network (CNN)/
Recurrent Neural Network (RNN)
PDF全文下载地址:
https://jeit.ac.cn/article/exportPdf?id=9944cdfe-5c14-48dc-aa88-fd23c1d43d83
