Research of Botnet Intrusion Detection Technology Based on the Flow

Abstract

In view of the current Botnet attack turning frequently, this paper analysis the double-stage propagation model of intelligent botnet, and puts forward a botnet detection method. This method adopts the concept of flow; for the first stage of the propagation, the paper puts forward the small flow filtering method, and reduces the number of flows needed to detect deeply effectively; for the second stage of the propagation, the paper adopts the thought of flow call-back, and detect each suspicious IP on the terminal router when botnet attacks cause network congestion, and then ensure the detection of botnet in real time.