基于流角色检测P2P botnet

提出了一种基于流角色的实时检测P2P botnet的模型，该模型从流本身的特性出发，使其在检测P2P botnet时处于不同的角色，以发现P2P botnet的本质异常和攻击异常，同时考虑到了网络应用程序对检测的影响。为进一步提高检测精度，提出了一种基于滑动窗口的实时估算Hurst指数的方法，并采用Kaufman算法来动态调整阈值。实验表明，该模型能有效检测新型P2P botnet。

Detecting P2P botnet based on the role of flows

Towards the weaknesses of the existing detection methods of P2P botnet,a novel real-time detection model based on the role of flows was proposed,which was named as RF.According to the characteristics of flows,the model made the flows play the different roles in the detection of the P2P botnet to detect the essential abnormality and the attacking abnormality.And the model considered the influence on the detection of the P2P botnet which the Web applications generated,especially the applications based on the P2P protocols.To minimize the false positive rate and false negative rate,a real-time method based on the sliding window to estimate the Hurst parameter was proposed,and the Kaufman algorithm was applied to adjust the threshold dynamically.The experiments showed that the model was able to detect the new P2P botnet with a relatively high precision.