With the security situation in Cyberspace constantly becoming worse, Cyber threat detection has attracted a lot of researching attentions. In this paper, existing detection technologies are firstly reviewed. Secondly, a framework of capturing the abnormal traffic of botnets is proposed. Major modules and key detection techniques are presented at the same time. The hidden threat detection in physically isolated network is also discussed, and a detection system capable of detecting and locating hidden malicious programs is proposed and validated by experiments. Conclusions and future researching suggestions are given finally.
Financed by the National Centre for Research and Development under grant No. SP/I/1/77065/10 by the strategic scientific research and experimental development program:
SYNAT - “Interdisciplinary System for Interactive Scientific and Scientific-Technical Information”.