论文部分内容阅读
由于对组织或个人采取针对性的攻击,僵尸网络对因特网构成越来越严重的威胁.并且不同的加密方法以及隐蔽的通信信道使得p2p僵尸网络越来越难以检测.之前有很多基于分类检测算法的文献都有很高的整体正确率,但是单独类并没有很高的正确率.同时,之前的文献并没有考虑到正常的网络流量和僵尸网络流量严重不平衡的问题.为了解决以上两个问题,提出一种基于最近邻规则欠抽样方法(ENN)和ADASYN(Adaptive Synthetic Sampling)结合的不均衡数据SVM分类算法应用于P2P僵尸网络检测.实验结果表明,无论是僵尸网络还是正常的流量,该方法都具有很高的正确率,并能在短时间内达到很好的分类效果;较之其他算法,它更适合处理大规模网络实时环境中大量的原始数据,对统计数据依赖性小,对不均衡数据分类具有较好的鲁棒性.因此,基于不均衡数据ENN-ADASYN-SVM分类算法更适应于复杂多变的网络环境下的P2P僵尸网络检测.
Botnets pose a more and more serious threat to the Internet due to the targeted attacks on organizations or individuals, and different encryption methods and covert communication channels make the p2p botnet more and more difficult to detect. Previously, many algorithms based on classification detection Of the documents have a high overall accuracy, but the single class does not have a high accuracy rate.At the same time, the previous literature did not take into account the normal network traffic and botnet traffic serious imbalance in order to solve the above two Problem, this paper proposes an unbalanced data SVM classification algorithm based on nearest neighbor rule undersampling (ENN) and ADASYN (Adaptive Synthetic Sampling) for P2P botnet detection.Experimental results show that, whether it is a botnet or a normal traffic, Compared with other algorithms, it is more suitable for processing a large amount of raw data in real-time environment of large-scale network, and has less dependence on statistical data. Therefore, this method has high accuracy and can achieve good classification results in a short time. It is more robust to unbalanced data classification.Therefore, the ENN-ADASYN-SVM classification algorithm based on unbalanced data is more suitable P2P botnet detection in a variety of network.