区域周期性检测策略：揭示P2P机器人威胁

118 浏览量更新于2024-07-15 收藏 718KB PDF 举报

本文探讨了"通过挖掘区域周期性来检测P2P机器人"这一主题，由Qiao等人在《浙江工业大学学报（计算机与电子科学版）》2013年第14卷第9期发表。P2P（Peer-to-Peer）机器人网络因其在逃避检测方面的优越性，已经成为当前互联网威胁的主要类型。传统检测方法，如基于网络行为相似性的分析和机器学习分类，往往难以应对不同网络环境和变种带来的挑战。作者观察到P2P机器人的一个重要但常被忽视的特点：它们会在控制与命令（C&C）阶段定期向其他节点发送更新请求或接收来自botmaster（控制者）的指令。这个特性是由于P2P网络的分布式结构和通信机制所决定的，使得botnet的行为在时间上呈现出一定的规律性。论文的创新之处在于，作者提出了一种利用这种区域周期性进行P2P机器人检测的新方法。该研究方法首先可能包括数据收集阶段，即监测P2P网络中的节点活动，记录它们的通信模式，特别是那些定期发生的行为。然后，通过分析这些行为的时间序列模式，识别出异常的、符合周期性规律的节点。这可能涉及到时间序列分析技术，如滑动窗口分析、周期性特征提取，以及统计模型，如自回归移动平均模型（ARIMA）或者季节性分解法（Seasonal Decomposition of Time Series, STL）来识别潜在的周期性模式。论文可能会进一步讨论如何处理周期性变化的噪声、如何适应不断变化的botnet行为变异，以及如何设计有效的阈值或机器学习算法来区分正常用户行为和恶意的周期性行为。此外，它还可能包含实验验证部分，展示了在真实或模拟环境中这种方法的有效性和鲁棒性，以及与现有检测方法的比较。这篇研究论文旨在填补当前P2P机器人检测方法中的空白，通过深入挖掘和利用P2P网络的区域周期性，提供一种新颖且实用的手段来对抗日益复杂的威胁。对于网络安全研究人员和防御策略制定者来说，理解并应用这些原理和技术具有重要意义。

Qiao et al. / J Zhejiang Univ-Sci C (Comput & Electron) 2013 14(9):682-700

685

However, the definition of the dense fragment set in

Sheng et al. (2006) is not suitable for a fast mining

algorithm, since its length is not a multiple of the

period.

3 P2P botnet detection model: DMRP

3.1 Motivation

P2P bots periodically search nodes to refresh

their local peer lists and to receive the latest com-

mands from their botmaster. This is due to the basic

demands of the P2P structure and the pre-programmed

behavior of bots. Meanwhile, P2P botnets always

employ Kademlia-like protocols to construct their

own C&C protocols just like popular P2P applications

such as eMule (http://www.emule-project.net/) and

BitTorrent (http://www.bittorrent.com/). In Kademlia

(Maymounkov and Mazieres, 2002), the self-updating

mechanism maintains the valid status of applications

by periodically sending node search requests to up-

date their node lists in order to obtain closer and more

stable neighbors. In P2P botnets, similarly, bots pe-

riodically send node search requests to obtain updated

commands and neighbors. This phenomenon suggests

that if we can capture the specific periodic behaviors

in traffic and distinguish them from other activities or

other periodic behaviors, we will be able to detect P2P

bots.

According to the above analysis, we propose a

P2P botnet traffic detection method by mining the

regional periodic patterns. ‘Regional’ indicates that

the periodic pattern might exist only within a limited

range rather than in the whole time series. A formu-

lated definition of regional periodic pattern will be

given Section 4.

Mining potential regional periodic patterns from

the time series of traffic features alone is not enough

for P2P bot detection. The existence of periodic pat-

terns is not a sufficient condition for the presence of

P2P bot traffic, as normal P2P applications and some

other network applications may also trigger periodic

behavior. Therefore, further steps are needed. In this

paper, we introduce an evaluation function to score

these mined patterns in order to recognize the P2P bot

traffic.

3.2 Detection model

As illustrated in Fig. 1, our P2P bot detection

model DMRP (detection by mining regional perio-

dicity) is composed of three major components: time

series extraction, regional periodic pattern mining,

and evaluation of traffic.

The workflow of DMRP can be summarized as

follows:

1. In the time series extraction phase, to reduce

redundant and noisy packets, only suspicious traffic

will be retained and then classified by internal hosts’

IP addresses. For each IP’s traffic, a time series of

traffic features will be extracted. At last, based on our

later definition of event types, the feature time series

will be transformed into an event time series.

2. In the second phase, for an event time series,

the circular autocorrelation function is first used to

search for candidate periods. Then, as the most im-

portant step in our model, we need to recognize re-

gional periodic patterns from current time series

based on the candidate periods.

3. In the final phase, the mined regional patterns

will be evaluated by an evaluation function. Detection

results of P2P bots are determined given the scores of

corresponding periodic patterns.

In Section 3.3 we will describe the time series

extraction method. The latter two phases about re-

gional periodic pattern mining and the evaluation

process will be explained in detail in Sections 4 and 5,

respectively.

3.3 Time series extraction

As shown in Fig. 1, the first module of DMRP

includes five steps:

Fig. 1 P2P bot detection model: DMRP (detection by

mining regional periodicity)

Capture suspicious

network traffic

Traffic filtering

Classify traffic by

host IPs

Obtain feature

time series

Time series

abstraction

Search probable

periods

Mine regional

periodic patterns

Regional periodic

pattern mining

Evaluation

function

Evaluation

of traffic

Three

algorithms

P 2P bot

detection

Obtain event time series

剩余18页未读，继续阅读

weixin_38733787

粉丝: 2
资源: 842

区域周期性检测策略：揭示P2P机器人威胁

使用树突状细胞算法检测P2P机器人

网络游戏-基于周期性通讯行为分析的P2P僵尸网络检测方法、系统.zip

ospf p2p好处

P2P贷款系统国内外研究现状

P2P 技术的负载均衡

华三配置OSPF P2P

P2P网络技术与流量监控

向日葵p2p断开连接

p2p云服务是什么_p2p云服务器是什么（p2p连接不上服务器是什么问题）

P2P主板有哪些优势？

最新资源