원문정보
초록
영어
Presently P2P-controlled bots has become an increasing threat to our network security due to the fact that P2P bots do not have a centralized point to shutdown or trace back, thus making the detection of P2P bots is very difficult. To enhance the detection rate, a new model to detect P2P bots on an individual host is proposed by improving the dendritic cells algorithm (IDCA). In the proposed approach, the raw data for P2P bot detection is obtained via APITrace tool. The processes ID are mapped into the antigens, and the behavioral data created by the processes are mapped into the signals, which are the time series input data of IDCA, are used to implement data fusion and correlation. The test experimental results show that the proposed method is effective to detect P2P-controlled bots on the host with low false positives.
목차
1. Introduction
2. Dendritic Cell Algorithm (DCA)
3. Improved DCA for Detection of P2P Bots
3.1 Data Collection
3.2 Signal and Antigen Mapping
3.3 Data Fusion
3.4 Correlation and Analysis
4. Experiments and Analysis
4.1 Experimental Setup
4.2 Experimental Results
5. Conclusions
References