Windows平台下僵尸网络检测原型系统设计与实现

发布时间：2018-06-06 05:12

本文选题：僵尸网络 + 僵尸网络检测　；参考：《中国科学院大学（工程管理与信息技术学院）》2014年硕士论文

【摘要】：根据国家互联网应急中心发布的《2013年中国互联网网络安全报告》中指出,每年我国有超过千万台的计算机感染恶意程序后沦为僵尸主机,而且数量在持续增加,被境外IP操控实施各种违法行为,尤其是依托其强大的协同性发起各类大规模攻击,严重危害了网络安全,进而威胁国家安全。因此,研制高效僵尸网络检测发现系统尤为迫切。目前检测方法大多依赖于在获得僵尸样本程序后,对已知的僵尸样本进行逆向分析,进而发现特征进行查杀,这种方法是在僵尸网络大规模爆发后,才能进行有效的发现和控制,而对未知的僵尸网络则无能为力。本文以实现对Windows平台下已知和未知类僵尸网络的检测为目标,通过研究和剖析典型的僵尸网络的特性,包括其工作原理、命令与控制机制、通信流量及主机行为特征等,在此基础上,突破僵尸网络检测关键技术,研究形成僵尸网络检测和识别的通用方法,设计并实现Windows平台下僵尸网络检测原型系统。具体内容包括： (1)剖析典型IRC、HTTP、P2P类型僵尸网络的工作原理、生命周期、命令与控制机制等特性,分析和提取僵尸网络的主机特征和流量特征。 (2)对已有僵尸网络检测技术进行了分析总结,在此基础上,提出多源数据采集技术、帧流分层联合识别的业务识别技术、僵尸样本程序自动分析技术和基于时空协同与相似特性的通用流量特征检测技术等僵尸网络检测关键技术。 (3)Windows平台下僵尸网络检测原型系统的设计与实现。充分考虑检测系统架构的合理性和高效性,设计了C/S结构的检测系统框架,包括各子系统的逻辑组成,各模块的功能实现。最后,对整个原型系统功能性能进行了实验验证。
[Abstract]:According to the 2013 China Internet Network Security report released by the State Internet Emergency response Center, more than 10 million computers in China become zombie hosts after they become infected with malicious programs every year, and the number is increasing. Being manipulated by overseas IP to carry out various illegal acts, especially relying on its strong cooperation to launch a variety of large-scale attacks, serious harm to network security, and then threaten national security. Therefore, it is urgent to develop an efficient botnet detection and discovery system. At present, most of the detection methods rely on reverse analysis of the known zombie samples after obtaining the zombie sample program, and then find out the characteristics of the botnet. This method is after the botnet broke out on a large scale. This paper aims at detecting known and unknown botnets under Windows platform and analyzes the characteristics of typical botnets. It includes its working principle, command and control mechanism, communication flow and host behavior characteristics, etc. On this basis, the key technology of botnet detection is broken through, and a general method of botnet detection and identification is developed. A botnet detection prototype system based on Windows platform is designed and implemented. The main contents are as follows: 1) analyzing the working principle, life cycle, command and control mechanism of typical IRC / HTTP P2P botnet. Based on the analysis and summary of the existing botnet detection technology, the multi-source data acquisition technology and the service identification technology of frame stream hierarchical joint identification are proposed, which is based on the analysis and extraction of host and traffic characteristics of botnet. The design and implementation of botnet detection prototype system based on Windows platform, such as botnet automatic analysis technology and general traffic feature detection technology based on spatio-temporal collaboration and similarity, are presented in this paper. Considering the rationality and efficiency of the detection system architecture, the detection system framework of C / S structure is designed, including the logical composition of each subsystem and the function realization of each module. Finally, the functional performance of the whole prototype system is verified experimentally.
【学位授予单位】：中国科学院大学（工程管理与信息技术学院）
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【参考文献】