基于统计特征的隐匿P2P主机实时检测系统StealthyP2P-NSFC.PDFVIP

Journal of Computer Applications ISSN 1001-9081 2015-35-10 计算机应用,2015, A5010433 CODEN JYIIDU 文章编号:1001-9081(2015)A5010433 doi:10.11772/j.issn.1001-9081.2015. A5010433 基于统计特征的隐匿P2P 主机实时检测系统 * 田朔玮 ，杨岳湘，何杰，王晓磊，江志雄 ( 国防科学技术大学 计算机学院，湖南 长沙) 410073 (*通信作者电子邮箱tsw777@) 摘 要: 针对当前隐匿恶意程序多转为使用分布式架构来应对检测和反制的问题，为快速精确地检测出处于隐匿阶段的 P2P 僵尸主机，最大限度的降低其危害，提出了一种基于统计特征的隐匿 P2P 主机实时检测系统。首先基于三个 P2P 主机统计特 征采用机器学习方法检测出监控网络内的所有 P2P 主机，然后再基于两个 P2P 僵尸主机统计特征，进一步检测出 P2P 僵尸主 机。实验结果证明，本系统能在 5 分钟内检测出监控网内所有隐匿的 P2P 僵尸主机，准确率高达到 99.7% ，而误报率仅为0.3%。 相较于现有检测方法，本系统检测所需统计特征少，且时间窗口较小，具备实时检测的能力。 关键词: P2P；僵尸网络；统计特征；机器学习；检测系统 中图分类号:TP393 文献标志码: A Stealthy P2P hosts real-time detection system based on statistical features * TIAN Shuo-wei , YANG Yue-xiang, HE Jie, WANG Xiao-lei, Jiang Zhi-xiong (College of Computer, National University of Defense Technology, 410073, China) Abstract: According to the fact that some malwares start shifting towards the decentralized architecture, which provides a better resiliency against detection and takedown efforts, a stealthy P2P bots real-time detection system is presented in order to detect P2P bots in real-time and minimize their destructiveness. Using means of machine learning algorithm, all the P2P hosts inside a monitored network are detected based on three statistical features, then P2P bots are discriminated in further detection based on two statistical features. The experimental results demonstrate that the system is able to detect stealthy P2P bots with an accuracy of 99.7% and a false positive rate below 0.3% within 5 minutes. Compared to the existing dete