| With the continuous evolution of the Internet,Botnets are characterized by diverse platforms,covert communication,and intelligent control.Public service resources such as 5G,Io T,intelligent terminals,cloud storage and social platforms,have gradually become fertile ground for botnets to breed.As an advanced form of malicious code,the main difference from other types of malwares is its Command and Control channel.Botmaster can control the server to launch a variety of complex network attack activities,including distributed denial of service attacks,click fraud,phishing,malware distribution,spam,identity theft,cryptocurrency mining and information leakage,which pose a serious threat to the ecological security of the Internet.Botnet detection is a highly concerned problem in the field of computer and network security.How to accurately detect botnets,especially covert and evolutionary botnets,has become one of the difficulties and hot spots in the academic community.Most of the real botnets are time-varying complex networks.In order to achieve the core objectives such as command control and data theft,botnets have relatively focused communication content and periodic similarity in communication behavior.Based on the theory of Complex Networks,this dissertation studies the detection problems related to botnets.The main work and innovation points are as follows.(1)Considering the current problems of single coverage of comprehensive botnet research,insufficient timeliness and imperfect classification and evaluation system,this dissertation sorts out the status of detection technology research and propose an evaluation method based on subjective and objective assignment method.In recent years,there is a lack of evolutionary analysis of new botnets.Most of the existing studies focus on one type or function,have a single dimension,do not cover the most cutting-edge technologies,and lack of comprehensive evaluation of detection technologies.This dissertation introduces the botnet construction mechanism in three dimensions: botnet architecture,life cycle,and command-and-control channel.This dissertation proposes a new classification method for botnet detection technology,which covers cutting-edge technologies such as Complex Networks,Deep Learning,Swarm Intelligence,and SDN.This dissertation proposes a general botnet detection system performance evaluation system CBDES from four dimensions: service,intelligence,collaboration,and assistant.The subjective and objective weighting method is used to quantitatively evaluate the typical detection methods,and the visual representation is given.(2)To address the challenges that unstructured P2 P botnets are often difficult to distinguish from legitimate traffic fusion and have more complex topology structure,this dissertation studies the detection framework of unstructured P2 P botnets based on self-avoidance random walk under the condition of incomplete topology information.The communication between bot programs constitutes a kind of overlay network,and the network flows of hosts of the same service type usually have similar group behavior patterns,and related studies show that nodes with shared neighbors usually belong to a kind of community.Based on network traffic data,the classical theory of complex network community discovery is introduced,and a self-avoiding random wandering-based botnet detection framework Peertrap is proposed for unstructured P2 P botnets under the condition of incomplete topological information.First,with the help of Apache Flink big data platform to extract five-tuple clusters,a traffic feature extraction rule is proposed to distinguish P2 P from non-P2 P clusters.Then,the Jaccard coefficient is used to calculate the confidence of P2 P cluster and construct the shared neighbor graph.Finally,a self-avoiding random walks algorithm is used for community partitioning,and two community attributes,Address Distribution degree and Mean Closeness Degree,are used to distinguish benign and malignant communities.Through experimental verification on Sality,Kelihos and Zero Access unstructured P2 P botnet data sets and CTU classical data sets,good results have been achieved in Precision,Recall,F1 value,MCC value and other evaluation indicators.This method is suitable for botnet detection in scenarios such as C&C channel encryption and overlapping benign and malignant P2 P traffic on hosts.(3)In view of the status quo of time-evolving botnets studied in few literatures,a botnet detection model based on dynamic graph attention network is studied by integrating the multidimensional data of node topology characteristics and traffic attributes.In this paper,a novel botnet detection method B-TGAT is proposed by introducing time-aware graph attention network,which integrates topology,edge attribute information and time information from the perspective of continuous time.It can effectively model the dynamic evolution of botnets,and can simultaneously characterize the structure and timing information of complex systems.Firstly,the original feature representation of nodes is generated by data preprocessing for network traffic.Then,the Temporal Graph Attention Neural Networks(TGAT)is used to effectively aggregate the temporal topological neighborhood features in the propagation process.Finally,the time-aware data is sent to FFN layer and softmax layer for classification.The experimental results on two new public datasets,NF-TON-Io T and NF-Bo T-Io T,and compared with the popular E-Graph SAGE and Extra Tree Classifier,show that the time participation features of nodes can effectively improve the accuracy of detection.Also,tests are conducted on the classical traffic dataset of botnet,CTU-13,showing that the method has good generality.(4)Aiming at the problem that the activities of key nodes in botnets are more complex and difficult to identify,the dynamic discovery of key nodes in botnets based on combinatorial optimization of deep reinforcement learning is studied.Critical nodes act as the communication bridge between the underlying zombie nodes and the upper control server.Identifying critical nodes is a further extension of botnet detection.Based on the node importance ranking theory of complex networks,this dissertation studies botnet defense strategy,introduces the combination optimization method of graph embedding and deep reinforcement learning into the key node identification problem of P2 P botnets,and proposes an intelligent key node identification model Peer Remove.Firstly,the Structure2 vec graph embedding pair is used to characterize the network structure information as a low-dimensional embedding space.Then,using N-step Q-learning deep reinforcement learning,agents are trained to learn complex topological patterns to find the key nodes that can effectively collapse the network.To evaluate the effectiveness of the algorithm,the Area Under the Curve(AUC)of the maximum connected subgraph size curve during node removal is applied as a metric.The dissertation selects six different types of P2 P botnet real or simulated datasets from Sality,Zero Access,NSIS,Mozi,Gnutella24 and Peer sampling service,and uses five dynamic and static node attack methods,HAD,Page Rank,CI,BPD and HPRA,which are more popular in recent years,as benchmark methods for experimental comparison.Finally,to verify the generality of the methods,tests are conducted on a centralized topological dataset.The results show that the overall AUC curve of Peer Remove method is lower than that of the benchmark method,and the method can minimize botnet resilience at a smaller cost,with better robustness. |
