Botnet detection method and controller

TL;DR: In this article, a botnet detection method and a controller is presented, which comprises steps: statistical information of each stream forwarding rule reported by an openflow switch in an SDN is received, wherein the statistical information comprises first matching times of a sub-stream forwarding rule and second matching time of a mother stream forwarding rules, an access probability set for each server to which any user terminal is accessed is determined, and similarities of user terminals accessed to any two servers are calculated by pairwise, and an access similarity matrix is obtained; and spectral clustering algorithm is adopted to carry

Abstract: The embodiment of the invention provides a Botnet detection method and a controller. The method comprises steps: statistical information of each stream forwarding rule reported by an openflow switch in an SDN is received, wherein the statistical information comprises first matching times of a sub stream forwarding rule and second matching times of a mother stream forwarding rule; according to the first matching times and the second matching times, an access probability set for each server to which any user terminal is accessed is determined; according to the access probability set, similarities of user terminals accessed to any two servers are calculated by pairwise, and an access similarity matrix is obtained; and spectral clustering algorithm is adopted to carry out spectral clustering on the access similarity matrix and according to a clustering result, whether a Botnet exists or not can be determined. A source IP address in the mother stream forwarding rule is a subnet address, the processing load of the controller can be greatly reduced, and the Botnet is determined based on access similarities, and the Botnet detection efficiency can be improved.