Botnet detection technology based on the on-line error model

摘要

Botnet is a serious information safety problem in the recent network. How to effectively find out the victim host and how to make the victim host free from the control of the botnet have become an urgent problem to be solved in the current network safety. In the paper, the use of the network online failure can distinguish the normal flow, P2P flow and the flow infected by the botnet. It can abstract the relevant characteristic values by observing the normal flow, the P2P flow and the online failure from the botnet intranet to the outer net, and then the characteristic values can create the detection model through the machine learning. The use of the detection model can distinguish the different kinds of flows.