IRC僵尸网络是攻击者通过IRC服务器构建命令与控制信道方式来控制大量主机组成的网络.IRC僵尸网络的动态性以及动态IP地址的影响,给僵尸网络的大小度量带来很大的困难.本文采用基于概率的动态IP地址去重算法减小动态IP地址的影响,给出僵尸网络大小尽量准确的度量,实验验证了本文方法的有效性.%IRC botnet can be regarded as a collection of compromised computers under the command-and-control infrastructure constructed by the IRC server. Since both the botnet and the IP are dynamic, the measure of botnet's size is difficult. The paper removes the duplicated and dynamic IP to estimate the size of the botnet. Experiments are carried out for validation purposes.
展开▼
