检测僵尸网络的贝叶斯算法的MapReduce并行化实现

PDF下载HTML

Title:

The parallel implementation of MapReduce for the Bayesian algorithm to detect botnets

作者:

邵秀丽¹, 刘一伟², 耿梅洁¹, 韩健斌³

1. 南开大学 计算机与控制工程学院, 天津 300071;
2. 北京大学 数学科学学院, 北京 100871;
3. 武警指挥学院 军事教育训练系, 天津 300250

Author(s):

SHAO Xiuli¹, LIU Yiwei², GENG Meijie¹, HAN Jianbin³

1. College of Computer and Control Engineering, Nankai University, Tianjin 300071, China;
2. School of Mathematical Sciences, Peking University, Beijing 100871, China;
3. Department of Education and Training, Armed Police Command College, Tianjin 300250, China

关键词:

僵尸网络; 检测僵尸网络; 贝叶斯算法; Hadoop; MapReduce; 流量

Keywords:

botnets; botnet detection; Bayesian algorithm; Hadoop; MapReduce; flow

分类号:

TP311

DOI:

10.3969/j.issn.1673-4785.201305011

摘要:

僵尸网络严重威胁互联网的安全, 目前主流的僵尸网络检测方法准确性较低, 针对此问题, 考虑贝叶斯算法具有较高的准确性, 提出了基于Hadoop平台的MapReduce机制的贝叶斯算法。该方法以主机对作为分析对象, 提取2个主机对通信的流量特征, 将这些特征作为贝叶斯分类算法的输入, 通过并行化计算贝叶斯算法训练阶段的先验概率和条件概率形成贝叶斯分类器, 使其学会辨认僵尸网络的流量。在检测阶段利用训练阶段形成的贝叶斯分类器和并行化计算后验概率, 实现检测僵尸网络。通过实验表明, 该方法检测僵尸网络是有效的, 检测正确率在90%以上, 并且该方法较单机检测僵尸网络的贝叶斯算法效率有了较大的提高。

Abstract:

The botnet network poses a serious threat to the Internet security, and the accuracy of the botnet detection method is low, while the Bayesian algorithm has high accuracy. This paper puts forward a Bayesian algorithm with the mechanism of MapReduce based on the Hadoop platform to achieve botnet detection. Taking the host-pairs as analysis objects, this method extracts the traffic features of communications between two hosts, takes these features as input and trains the Bayesian classifier through parallel calculations of the prior probability and condition probability on the stage of the Bayesian algorithm training to learn to recognize botnet traffic. By using the Bayesian classifier trained on the stage of the Bayesian algorithm training and parallel calculations of the posterior probability on the stage of detecting, the detection of botnets can be achieved. Experiments show that the method for detecting botnets is effective and the correct detection rate is more than 90%. The efficiency of this method is greatly improved as compared with detecting the single Bayesian algorithm of the botnets.