强抗毁性社交僵尸网络的构建及其防御

发布时间：2019-06-26 13:31

【摘要】：为打击僵尸网络,保障网络空间安全,提出一种新型的具备强抗毁性的社交僵尸网络(DR-SNbot),并给出了针对性的防御方法。DR-SNbot基于社交网络搭建命令与控制服务器(CC-Server,command and control server),每个CC-Server对应一个不同的伪随机昵称,并利用信息隐藏技术将命令隐藏在日志中发布,进而提出一种新型的命令与控制信道。当CC-Server不同比例地失效时,DR-SNbot会发出不同等级的预警,通知攻击者构建新的CC-Server,并自动修复CC通信以保障其强抗毁性。在实验环境中,即使当前CC-Server全部失效,DR-SNbot仍能在短期内修复CC通信,将控制率维持在100%。最后,基于伪随机僵尸昵称与合法昵称在词法特征上的差异性,提出一种僵尸昵称检测方法,可有效检测社交僵尸网络利用自定义算法批量生成的伪随机僵尸昵称。实验结果表明,该方法召回率达到93%,准确率达到96.88%。
[Abstract]:In order to combat botnet and ensure the security of cyberspace, a new type of social botnet (DR-SNbot) with strong invulnerability is proposed, and a targeted defense method is given. Dr-SNbot builds command and control server based on social network (each CC-Server of CC-Server,command and control server), corresponds to a different pseudorandom nickname, and uses information hiding technology to hide the command in the log. Furthermore, a new type of command and control channel is proposed. When CC-Server fails in different proportion, DR-SNbot will issue different levels of early warning, informing the attacker to build a new CC-Server, and automatically repair CC communication to ensure its strong invulnerability. In the experimental environment, even if the current CC-Server is completely invalid, DR-SNbot can still repair CC communication in a short period of time and maintain the control rate at 100%. Finally, based on the difference of lexical features between pseudorandom zombie nicknames and legitimate nicknames, a zombie nickname detection method is proposed, which can effectively detect pseudorandom zombie nicknames generated in batches by custom algorithms in social botnet. The experimental results show that the recall rate and accuracy of the method are 93% and 96.88% respectively.
【作者单位】：中国科学院信息工程研究所;中国科学院大学;国家计算机应急技术处理协调中心;
【基金】：国家自然科学基金资助项目(No.61572496) 国家高技术研究发展计划(“863”计划)基金资助项目(No.2013AA014703,No.2012AA012801)~~
【分类号】：TP393.08

【相似文献】