排序方式: 共有34条查询结果,搜索用时 629 毫秒
21.
22.
僵尸网络是由许多台被恶意代码感染控制并与互联网相互连接的计算机所组成,其正步入快速发展期,并已对因特网安全造成了严重威胁。文章针对目前国际上主流僵尸网络检测算法进行分析和比较,给出每种检测算法的优点和不足。 相似文献
23.
Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol(IP) addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol(DHCP),so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can’t be always online.The whole process is carried out under the command and control(C&C) channel.Our goal is to characterize the network traffic under the C&C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider(ISP) Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection(DPI) Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C&C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection(DFI) technology. 相似文献
24.
25.
26.
针对现有僵尸网络检测体系结构中协同功能的不足,给出了一个基于多智能体社会的协同防御模型.模拟多智能体社会中的成员间的协同关系,设计了侦查、检测与反制三种社会成员角色,提出了基于协同防御模型的三层协同防御体系.典型案例分析表明本文模型具有较强的可扩展性和可交互性,可以灵活地部署在各种要保护的网络上,适应各种应用环境,具有较好的应用价值. 相似文献
27.
28.
29.
僵尸网络检测方法研究 总被引:2,自引:0,他引:2
僵尸网络是指由黑客通过多种传播手段入侵并控制的主机组成的网络.僵尸网络是各种恶意软件传播和控制的主要来源,检测僵尸网络对于网络安全非常重要.本文首先介绍了僵尸网络的结构,着重对僵尸网络的命令与控制信道进行了讨论,接着详细介绍了基于主机信息的、基于流量监测的和基于对等网络的僵尸网络检测方法,并进行了比较和讨论. 相似文献
30.
李明 《电信工程技术与标准化》2010,23(2):37-40
本文简述了僵尸网络的定义,演变和最新的增长趋势,指出了其主要危害方式和影响。指出分层的防御是对应僵尸网络威胁的主要方式,并介绍了迈克菲研究室的最新研究成果——通过漏洞阻断、云安全和行为分析的模式对于僵尸网络在网络中的传播进行阻断。为僵尸网络的防御提供了有益的参考建议。 相似文献