针对僵尸主机的检测反制系统设计与实现

发布时间：2018-11-06 10:45

【摘要】：僵尸网络是指控制者通过僵尸程序控制大量被感染的计算机而形成的一种攻击网络,恶意控制者可以利用该网络发送垃圾邮件、发出恶意攻击流量等多种形式的恶意行为。新式僵尸网络利用P2P分布式协议进行节点通信,保障了通信与命令信道的隐秘性,进而使得僵尸网络成为互联网史上最严重的威胁之一。目前对P2P僵尸网络的讨论往往集中在分析其生存模型,并未研究出高效的僵尸网络检测技术。对于新式僵尸网络,现有的检测系统必须具备先验知识,仅能检测少数几种僵尸网络。本文首先介绍了当前学术界对于僵尸网络的基本认识,给出僵尸网络的定义和当前检测反制僵尸网络的主流技术,并分析其优缺点。之后针对几种常见僵尸程序分析其通讯流量特征和结构特征,得出僵尸网络的通用特征。最终设计出一种针对半分布僵尸网络的检测系统,该系统包含捕获模块,恶意流量检测模块,数据存储模块,反制模块,结果输出模块。恶意流量检测模块包含两种检测引擎,流量宏观特征检测引擎和恶意特征检测引擎,流量宏观特征检测引擎从空间和时间两个角度对僵尸流量进行分析,筛选数据同步时间,数据包大小等信息,利用FCM聚类算法将可疑节点初步检测,之后利用网络结构特征进一步筛选僵尸节点。该方法在保证较高的正确性的前提下,不需要分析具体通信内容,更不被通信协议所限制。深度包检测模块通过提取通信数据包的特征字进行僵尸程序检测,借此鉴定已知僵尸程序。反制模块针对恶意流量检测模块的检测结果进行反制,降低僵尸网络的危害。本文使用多种僵尸程序进行验证都取得了良好的效果,证明了该系统的有效性。
[Abstract]:Botnet is an attack network formed by the control of a large number of infected computers by the botnet program. The malicious controller can use the network to send spam and send out malicious attack traffic and other forms of malicious behavior. The new botnet uses P2P distributed protocol for node communication, which ensures the privacy of communication and command channel, which makes botnet become one of the most serious threats in the history of Internet. At present, the discussion of P2P botnet is usually focused on analyzing its survival model, and no efficient botnet detection technology has been developed. For new botnets, existing detection systems must have prior knowledge and can detect only a few botnets. This paper first introduces the basic knowledge of botnet in academic circles, gives the definition of botnet and the mainstream technology of detecting anti-botnet, and analyzes its advantages and disadvantages. Then, the common features of botnet are obtained by analyzing the characteristics of traffic and structure of several common botnet programs. Finally, a detection system for semi-distributed botnet is designed. The system includes capture module, malicious traffic detection module, data storage module, counter-control module and result output module. The malicious traffic detection module includes two detection engines, the traffic macro feature detection engine and the malicious feature detection engine. The traffic macro feature detection engine analyzes the zombie traffic from two aspects of space and time, and selects the synchronization time of the data. The FCM clustering algorithm is used to detect the suspicious nodes, and then the zombie nodes are selected by using the network structure features. On the premise of high accuracy, the method does not need to analyze the concrete communication content, and is not restricted by the communication protocol. The depth packet detection module detects the zombie program by extracting the characteristic words of the communication packet, and then identifies the known zombie program. The counter-control module counteracts the detection result of malicious traffic detection module and reduces the harm of botnet. In this paper, a variety of zombie programs are used to verify the effectiveness of the system.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【参考文献】