CAJ | 학술논문

僵尸网络严重威胁互联网的安全，目前主流的僵尸网络检测方法准确性较低，针对此问题，考虑贝叶斯算法具有较高的准确性，提出了基于Hadoop平台的MapReduce机制的贝叶斯算法。该方法以主机对作为分析对象，提取2个主机对通信的流量特征，将这些特征作为贝叶斯分类算法的输入，通过并行化计算贝叶斯算法训练阶段的先验概率和条件概率形成贝叶斯分类器，使其学会辨认僵尸网络的流量。在检测阶段利用训练阶段形成的贝叶斯分类器和并行化计算后验概率，实现检测僵尸网络。通过实验表明，该方法检测僵尸网络是有效的，检测正确率在90％以上，并且该方法较单机检测僵尸网络的贝叶斯算法效率有了较大的提高。
강시망락엄중위협호련망적안전，목전주류적강시망락검측방법준학성교저，침대차문제，고필패협사산법구유교고적준학성，제출료기우Hadoop평태적MapReduce궤제적패협사산법。해방법이주궤대작위분석대상，제취2개주궤대통신적류량특정，장저사특정작위패협사분류산법적수입，통과병행화계산패협사산법훈련계단적선험개솔화조건개솔형성패협사분류기，사기학회변인강시망락적류량。재검측계단이용훈련계단형성적패협사분류기화병행화계산후험개솔，실현검측강시망락。통과실험표명，해방법검측강시망락시유효적，검측정학솔재90％이상，병차해방법교단궤검측강시망락적패협사산법효솔유료교대적제고。
The botnet network poses a serious threat to the Internet security , and the accuracy of the botnet detec-tion method is low , while the Bayesian algorithm has high accuracy .This paper puts forward a Bayesian algorithm with the mechanism of MapReduce based on the Hadoop platform to achieve botnet detection .Taking the host-pairs as analysis objects, this method extracts the traffic features of communications between two hosts , takes these fea-tures as input and trains the Bayesian classifier through parallel calculations of the prior probability and condition probability on the stage of the Bayesian algorithm training to learn to recognize botnet traffic .By using the Bayesian classifier trained on the stage of the Bayesian algorithm training and parallel calculations of the posterior probability on the stage of detecting , the detection of botnets can be achieved .Experiments show that the method for detecting botnets is effective and the correct detection rate is more than 90%.The efficiency of this method is greatly im-proved as compared with detecting the single Bayesian algorithm of the botnets .