基于分布式的僵尸网络主动探测方法研究

发布时间：2018-07-15 22:02

【摘要】：僵尸网络是当前互联网上存在的一类严重安全威胁。传统的被动监控方法需要经过证据积累、检测和反应的过程,只能在实际恶意活动发生之后发现僵尸网络的存在。提出了基于僵尸网络控制端通信协议指纹的分布式主动探测方法,通过逆向分析僵尸网络的控制端和被控端样本,提取僵尸网络通信协议,并从控制端回复信息中抽取通信协议交互指纹,最后基于通信协议指纹对网络上的主机进行主动探测。基于该方法,设计并实现了ActiveSpear主动探测系统,该系统采用分布式架构,扫描所使用的IP动态变化,支持对多种通信协议的僵尸网络控制端的并行扫描。在实验环境中对系统的功能性验证证明了方法的有效性,实际环境中对系统扫描效率的评估说明系统能够在可接受的时间内完成对网段的大规模扫描。
[Abstract]:Botnet is a serious security threat on the Internet. The traditional passive monitoring method needs the process of accumulation of evidence, detection and reaction, and can only discover the existence of botnet after the actual malicious activity. A distributed active detection method based on botnet control end communication protocol fingerprint is proposed. The botnet communication protocol is extracted by reverse analysis of botnet control end and controlled end samples. The interactive fingerprint of the communication protocol is extracted from the response information of the control end. Finally, the host computer on the network is detected actively based on the fingerprint of the communication protocol. Based on this method, an active detection system for active Spear is designed and implemented. The system uses a distributed architecture to scan the dynamic changes of IP used, and supports parallel scanning of botnet control terminal of various communication protocols. The effectiveness of the method is proved by the functional verification of the system in the experimental environment. The evaluation of the system scanning efficiency in the actual environment shows that the system can complete the large-scale scanning of the network segment in an acceptable time.
【作者单位】：国家计算机网络应急技术处理协调中心;北京大学计算机科学技术研究所;
【基金】：国家242信息安全计划基金资助项目(2011A40) 国家自然科学基金资助项目(61003127)~~
【分类号】：TP393.08

【相似文献】