论文部分内容阅读
僵尸网络（Botnet）检测已经成为近年来网络安全领域的研究热点之一，Botnet的一个显著特点是能建立C＆C通道，攻击者可以通过这个通道给bots发送命令，并接收与命令相对应的响应，而响应往往会引起网络流量的突变。基于这一特点，本文提出一种改进的CUSUM的算法，对僵尸网络流量中的突变点进行检测。经实验表明，本文所采用的算法是有效的，能有效地检测出流量中的突变点，并且能提高检测速度和准确率。“,”The detection of Botnet has become one of the hot spots in network security research. An extinct characteristic of Botnet is to build up C＆C channel through which the attacker would be able to send commands to bots and receive the responses. The response action is likely to cause a sudden change in network traffic. Based on the characteristic of the change point, we propose an improved CUSUM algorithm in this paper to detect the change point in network traffic of Botnet. The experiment result shows that the algorithm we proposed is effective to detect the change point in network traffic of Botnet with a higher detection ratio and a higher accuracy.