论文标题
在动态通信图中检测P2P僵尸网络群落的增强方法
A Reinforcement Approach for Detecting P2P Botnet Communities in Dynamic Communication Graphs
论文作者
论文摘要
点对点（P2P）僵尸网络使用分散的命令和控制网络，使其能够弹性地破坏。 P2P僵尸网络叠加网络在使用网络流量信息形成的相互接触图中表现出结构，也称为通信图。已经表明，可以使用图理论中的社区检测技术来检测这些结构。但是，这些先前的作品将通信图和P2P僵尸网络结构视为静态。实际上，通信图代表了不断变化的网络流量流动，它们是动态的。同样，随着新机器人的加入，P2P僵尸网络也随时间发展，现有机器人暂时或永久离开。在本文中，我们解决了在动态通信图中检测这种不断发展的P2P僵尸网络群落的问题。我们提出了一种适用于大型通信图的基于增强的方法，可改善动态通信图中P2P僵尸网络社区检测的精确度和回忆。
Peer-to-peer (P2P) botnets use decentralized command and control networks that make them resilient to disruptions. The P2P botnet overlay networks manifest structures in mutual-contact graphs, also called communication graphs, formed using network traffic information. It has been shown that these structures can be detected using community detection techniques from graph theory. These previous works, however, treat the communication graphs and the P2P botnet structures as static. In reality, communication graphs are dynamic as they represent the continuously changing network traffic flows. Similarly, the P2P botnets also evolve with time, as new bots join and existing bots leave either temporarily or permanently. In this paper we address the problem of detecting such evolving P2P botnet communities in dynamic communication graphs. We propose a reinforcement-based approach, suitable for large communication graphs, that improves precision and recall of P2P botnet community detection in dynamic communication graphs.
