基于消息推送的流量自适应移动僵尸网络

发布时间：2019-06-22 11:36

【摘要】：近年来，随着移动互联网的不断快速发展以及智能手机、平板电脑等移动终端的不断普及，从传统PC端的僵尸网络发展而来的移动僵尸网络正逐渐成为攻击者手中最为有效的攻击手段，攻击者不仅可以通过移动僵尸网络获取用户移动终端中的隐私信息，并且可以通过用户的移动设备在用户不知情的情况下订购高额的付费服务，并且还可以通过用户单个移动终端向其他的用户进行传播，从而对用户造成隐私以及财务方面的危害。对于移动僵尸网络的提前感知和应对是处理移动僵尸网络的关键。所以对于移动僵尸网络核心的命令与控制机制的研究显得尤为重要。移动僵尸网络两个最主要的特性分别是实时性和隐蔽性，因为攻击者所发布的命令都具有一定的时效性，一个有效的僵尸网络必须对攻击者的命令做出及时有效的处理，这就对僵尸终端的时效性要求很高，因为一旦错过时间，相应的攻击行为可能失去意义；另外一个方面因为移动僵尸网络作为一个攻击性的恶意程序，必须在用户不知情的情况下去执行相应的命令，如果被用户感知必然相应的信道会被截断，，从而导致该移动僵尸终端失效，所以对于移动僵尸网络而言，隐蔽性也是相当重要的一个方面。为了能够有效地应对移动僵尸网络，对移动僵尸网络核心的命令与控制机制的研究就显得尤为重要，本文从隐蔽性以及实时性出发研究了一种基于消息推送的流量自适应移动僵尸网络命令与控制机制。由于在3G以及WiFi环境下安全限制的等级有所不同，所以对于移动僵尸网络而言，僵尸终端利用移动设备网络连接状态、命令紧迫程度、攻击流量消耗、用户正常流量消耗等条件，通过相应的调度算法来实现流量自适应处理能很好地提高隐蔽性，并且通过消息推送机制将命令实时地推送到僵尸终端，僵尸网络的时效性也相当有效。实验结果显示，该类型的移动僵尸网络命令与控制机制的时效性和隐蔽性都很强，需引起重视。
[Abstract]:In recent years, with the rapid development of the mobile Internet and the popularity of mobile terminals such as smartphones, tablets and other mobile terminals, the mobile botnet developed from the traditional PC botnet is gradually becoming the most effective means of attack in the hands of attackers. Attackers can not only obtain the privacy information of the user's mobile terminal through the mobile botnet. It can also order high payment services without the user's knowledge through the user's mobile device, and can also spread to other users through a single mobile terminal, thus causing privacy and financial harm to the user. The early perception and response to mobile botnet is the key to deal with mobile botnet. Therefore, the research on the command and control mechanism of mobile botnet core is particularly important. The two most important characteristics of mobile botnet are real-time and concealment, because the commands issued by attackers have certain timeliness, an effective botnet must deal with the commands of attackers in a timely and effective manner, which requires high timeliness of botnet, because once the time is missed, the corresponding attack behavior may be meaningless. On the other hand, as an offensive malicious program, mobile botnet must execute the corresponding command without the user's knowledge. If the corresponding channel is sensed by the user, the corresponding channel will be truncated, which will lead to the failure of the mobile botnet, so concealment is also a very important aspect for mobile botnet. In order to deal with mobile botnet effectively, it is particularly important to study the command and control mechanism of mobile botnet core. In this paper, a traffic adaptive mobile botnet command and control mechanism based on message push is studied from the perspective of concealment and real-time. Because of the different levels of security restrictions in 3G and WiFi environment, for mobile botnet, zombie terminal can improve concealment by using the conditions of mobile device network connection state, command urgency, attack traffic consumption, user normal traffic consumption and so on, and the command can be pushed to zombie terminal in real time through message push mechanism. Botnet timeliness is also quite effective. The experimental results show that the timeliness and concealment of this type of mobile botnet command and control mechanism are very strong and need to be paid attention to.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】