关键词: P2P僵尸网络, 快速检测, 增量式分类, 动态聚类, 布尔自相关

Abstract: The attacks due to P2P-based botnet are increasingly one of the most serious threats to the Internet. The existing detection strategies for P2P-based botnets just focus on the offline detection methods by tracking the historical network traffic, which can hardly meet the requirement for real-time and precision. A new technique is therefore proposed to detect the P2P-based botnet activities rapidly, where an improved incremental classification technique is introduced to distinguish the P2P-based network traffic from others. Then a dynamical clustering technique and Boolean auto-correlation technique are presented to detect the suspected P2P-based botnet hosts which have the similarity and periodicity in communication behavior. The experimental evaluations showed that the technique proposed can implement the detection for P2P-based botnets rapidly and efficiently.