论文部分内容阅读
僵尸频道是基于因特网在线聊天(Internet relay chat,IRC)协议僵尸网络传递控制命令,操纵整个网络的唯一途径。该文针对IRC僵尸网络频道检测问题,提出一种利用僵尸网络控制命令语法结构特征,实现检测僵尸网络频道的方法。使用可信系数描述频道中的字符串为僵尸网络控制命令的可能性,并结合可信系数,改进阈值随机游走(threshold random walk,TRW)算法,用以加快僵尸网络频道检测速度。实验结果表明:该方法对僵尸频道有很好的识别能力,检测效率明显提高。
Zombie Channel is the only way to deliver control commands and manipulate the entire network based on the Internet Relay Chat (IRC) protocol botnet. In this paper, aiming at detecting channel of IRC botnet, this paper proposes a method to control the botnet channel by using the structure features of botnet control command syntax. The use of the trustworthiness coefficient to describe the possibility of the string in the channel for botnet control commands and the improvement of the threshold random walk (TRW) algorithm in combination with the credible factor to speed up the botnet channel detection. The experimental results show that this method has a good recognition ability for zombie channels and the detection efficiency is obviously improved.