强抗毁性社交僵尸网络的构建及其防御

doi:10.11959/j.issn.1000-436x.2017012

通信学报 ›› 2017, Vol. 38 ›› Issue (1): 97-105.doi: 10.11959/j.issn.1000-436x.2017012

强抗毁性社交僵尸网络的构建及其防御

尹涛^1,²,李世淙³,庹宇鹏^1,²,张永铮^1,²

¹ 中国科学院信息工程研究所，北京 100093
² 中国科学院大学，北京100049
³ 国家计算机应急技术处理协调中心，北京 100029

修回日期:2016-10-25 出版日期:2017-01-01 发布日期:2017-01-23
作者简介:尹涛（1989-），男，重庆人，中国科学院信息工程研究所博士生，主要研究方向为网络与信息安全。|李世淙（1981-），男，山东临沂人，国家计算机应急技术处理协调中心工程师，主要研究方向为网络安全事件监测、网络行为分析。|庹宇鹏（1984-），男，河北廊坊人，中国科学院信息工程研究所助理研究员，主要研究方向为网络异常检测、移动互联网大数据挖掘。|张永铮（1978-），男，黑龙江哈尔滨人，博士，中国科学院信息工程研究所研究员、博士生导师，主要研究方向为网络安全态势感知。
基金资助:
国家自然科学基金资助项目(61572496);国家高技术研究发展计划（“863”计划）基金资助项目(2013AA014703);国家高技术研究发展计划（“863”计划）基金资助项目(2012AA012801)

Modeling and countermeasures of a social network-based botnet with strong destroy-resistance

Tao YIN^1,²,Shi-cong LI³,Yu-peng TUO^1,²,Yong-zheng ZHANG^1,²

¹ Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China
² University of Chinese Academy of Sciences,Beijing 100049,China
³ National Computer Network Emergency Response Technical Team / Coordination Center of China,Beijing 100029,China

Revised:2016-10-25 Online:2017-01-01 Published:2017-01-23
Supported by:
The National Natural Science Foundation of China(61572496);The National High Technology Research and Development Program of China (863 Program)(2013AA014703);The National High Technology Research and Development Program of China (863 Program)(2012AA012801)

摘要/Abstract

摘要：

为打击僵尸网络，保障网络空间安全，提出一种新型的具备强抗毁性的社交僵尸网络（DR-SNbot），并给出了针对性的防御方法。DR-SNbot 基于社交网络搭建命令与控制服务器（C＆C-Server,command and control server），每个 C＆C-Server 对应一个不同的伪随机昵称，并利用信息隐藏技术将命令隐藏在日志中发布，进而提出一种新型的命令与控制信道。当C＆C-Server不同比例地失效时，DR-SNbot会发出不同等级的预警，通知攻击者构建新的C＆C-Server，并自动修复C＆C通信以保障其强抗毁性。在实验环境中，即使当前C＆C-Server全部失效，DR-SNbot仍能在短期内修复C＆C通信，将控制率维持在100%。最后，基于伪随机僵尸昵称与合法昵称在词法特征上的差异性，提出一种僵尸昵称检测方法，可有效检测社交僵尸网络利用自定义算法批量生成的伪随机僵尸昵称。实验结果表明，该方法召回率达到93%，准确率达到96.88%。

关键词: 网络安全, 社交网络, 僵尸网络, 命令与控制信道, 防御策略

Abstract:

To defeat botnets and ensure cyberspace security,a novel social network-based botnet with strong destroy-resistance (DR-SNbot),as well as its corresponding countermeasure,was proposed.DR-SNbot constructed command and control servers (C＆C-Servers) based on social network.Each C＆C-Server corresponded to a unique pseudo-random nickname.The botmaster issues commanded by hiding them in diaries using information hiding techniques,and then a novel C＆C channel was established.When different proportions of C＆C-Servers were invalid,DR-SNbot would send out different levels of alarms to inform attackers to construct new C＆C-Servers.Then,DR-SNbot could automatically repair C＆C communication to ensure its strong destroy-resistance.Under the experimental settings,DR-SNbot could resume the C＆C communication in a short period of time to keep 100% of the control rate even if all the current C＆C-Servers were invalid.Finally,a botnet nickname detecting method was proposed based on the difference of lexical features of legal nicknames and pseudo-random nicknames.Experimental results show that the proposed method can effectively (precision:96.88%,recall:93%) detect pseudo-random nicknames generated by social network-based botnets with customized algorithms.

Key words: network security, social networks, botnet, command and control channel, countermeasure

中图分类号:

TP393.08

尹涛,李世淙,庹宇鹏,张永铮. 强抗毁性社交僵尸网络的构建及其防御[J]. 通信学报, 2017, 38(1): 97-105.

Tao YIN,Shi-cong LI,Yu-peng TUO,Yong-zheng ZHANG. Modeling and countermeasures of a social network-based botnet with strong destroy-resistance[J]. Journal on Communications, 2017, 38(1): 97-105.

图/表 9

图1

图2

表1

图3

图4

图5

表2

图6

图7

参考文献 20

[1]	FABIAN M , TERZIM s . A multifaceted approach to understanding the botnet phenomenon[C]// 2006 ACM SIGCOMM Internet Measurement Conference (IMC). 2006.
[2]	KWAK H , LEE C , PARK H ,et al. What is twitter,a social network or a news media[C]// 19th International Conference on World Wide Web,ACM. 2010: 591-600.
[3]	ABRAHAM S,CHENGALUR-SMITH I . An overview of social engineering malware:Trends,tactics and implications[J]. Technology in Society, 2010,32(3):18196.
[4]	LI S , YUN X , HAO Z ,et al. Modeling social engineering botnet dynamics across multiple social networks[J]. Information Security and Privacy Research, 2012: 261-272.
[5]	ATHANASOPOULOS E , MAKRIDAKIS A , ANTONATOS S ,et al. Antisocial networks:turning a social network into a botnet[C]// Information Security,ICS. 2008: 146-160.
[6]	MA X , GUAN X , TAO J ,et al. A novel IRC botnet detection method based on packet size sequence[C]// 2010 IEEE International Conference on Communications (ICC). 2010: 1-5.
[7]	ZOU C , CUNNINGHAM R . Honeypot-aware advanced botnet construction and maintenance[C]// Dependable Systems and Networks,2006.DSN 2006.International Conference. 2006: 199-208.
[8]	SU C , ZHANG L F , GUAN Y ,et al. A framework for P2P botnets[C]// International Conference on Communications and Mobile Computing. 2009.
[9]	WANG P , SPARKS S , ZOU C . An advanced hybrid peer-to-peer botnet[J]. Dependable and Secure Computing,IEEE Transactions, 2010,7(2):11127.
[10]	VOGT R , AYCOCK J . Attack of the 50 foot Botnet[EB/OL]. .
[11]	李书豪, 云晓春, 郝志宇 ,等. MRRbot:基于冗余机制的多角色P2P僵尸网络模型[J]. 计算机研究与发展, 2011,48(8): 1488-1496.
	LI S H , YUN X C , HAO Z Y ,et al. MRRbot:a multi-role and redundancy-based P2P botnet model[J]. Journal of Computer Research and Development, 2011,48(8): 1488-1496.
[12]	HA D , YAN G , EIDENBENZ S ,et al. On the effectiveness of structural detection and defense against P2P-based botnets[C]// IEEE/IFIP International Conference on Dependable Systems ＆ Networks,2009.DSN09. 2009: 297-306.
[13]	李跃, 翟立东, 王宏霞 ,等. 一种基于社交网络的移动僵尸网络研究[J]. 计算机研究与发展, 2012,49(Suppl.): 1-8.
	LI Y , ZHAI L D , WANG H X ,et al. Mobile botnet based on SNS[J]. Journal of Computer Research and Development, 2012,49(Suppl.): 1-8.
[14]	KARTALTEPE E , MORALES J , XU S ,et al. Social network-based botnet command-and-control:emerging threats and countermeasures[C]// Applied Cryptography and Network Security. 2010: 511-528.
[15]	THOMAS K , NICOL D . The koobface botnet and the rise of social malware[C]// Malicious and Unwanted Software (MALWARE),2010 5th International Conference. 2010: 63-70.
[16]	NAGARAJA S , HOUMANSADR A , PIYAWONGWISAL P ,et al. Stegobot:a covert social network botnet[C]// Information Hiding,Springer. 2011: 299-313.
[17]	CUI X , FANG B , YIN L ,et al. AndBot:towards advanced mobile botnets[C]// 4th USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’11). 2011.
[18]	LIU C , LU W , ZHANG Z ,et al. A recoverable hybrid C＆C botnet[C]// 2011 6th International Conference on Malicious and Unwanted Software (MALWARE). 2011: 110-118.
[19]	YADAV S , REDDY A K K , REDDY A L ,et al. Detecting algorithmically generated malicious domain names[C]// 10th ACM SIGCOMM Conference on Internet Measurement. 2010: 48-61.
[20]	BORGELT C , KRUSE R . Induction of association rules:apriori implementation[C]// Compstat.Physica-Verlag HD. 2002: 395-400.

编号	14:00	14:20	14:40	15:00
CS₁	0	4→4	7→/	/
CS₂	0	2→2	8→/	/
CS₃	0	5→/	/→/	/
CS₄	0	4→4	5→/	/
CS₅	0	5→/	/→/	/
CS₆	/	/→/	/→0	3
CS₇	/	/→/	/→0	5
CS₈	/	/→/	/→0	4
CS₉	/	/→/	/→0	5
CS₁₀	/	/→/	/→0	3
总计	0	20→10	20→0	20

昵称	1阶子序列	2阶子序列
abc123	a,b,c,1,2,3	ab,bc,c1,12,23

强抗毁性社交僵尸网络的构建及其防御

Modeling and countermeasures of a social network-based botnet with strong destroy-resistance

在线阅读

PDF下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 20

相关文章 15

Metrics

推荐阅读 0

[1]	赵仕祺, 黄小红, 钟志港. 基于信誉的域间路由选择机制的研究与实现[J]. 通信学报, 2023, 44(6): 47-56.
[2]	刘盈泽, 郭渊博, 方晨, 李勇飞, 陈庆礼. 基于有限理性的网络防御策略智能规划方法[J]. 通信学报, 2023, 44(5): 52-63.
[3]	谢人超, 文雯, 唐琴琴, 刘云龙, 谢高畅, 黄韬. 轨道交通移动边缘计算网络安全综述[J]. 通信学报, 2023, 44(4): 201-215.
[4]	徐明, 张保俊, 伍益明, 应晨铎, 郑宁. 面向网络攻击和隐私保护的多智能体系统分布式共识算法[J]. 通信学报, 2023, 44(3): 117-127.
[5]	康海燕, 龙墨澜. 基于吸收马尔可夫链攻击图的网络攻击分析方法研究[J]. 通信学报, 2023, 44(2): 122-135.
[6]	王璿, 张瑜, 周军锋, 陈子阳. 基于社交网络的影响力最大化算法[J]. 通信学报, 2022, 43(8): 151-163.
[7]	郭渊博, 李勇飞, 陈庆礼, 方晨, 胡阳阳. 融合Focal Loss的网络威胁情报实体抽取[J]. 通信学报, 2022, 43(7): 85-92.
[8]	彭滔, 钟文韬, 王国军, 罗恩韬, 熊金波, 刘忆宁, Hao Wang. 移动社交网络中面向隐私保护的精确好友匹配[J]. 通信学报, 2022, 43(11): 90-103.
[9]	邹福泰, 谭越, 王林, 蒋永康. 基于生成对抗网络的僵尸网络检测[J]. 通信学报, 2021, 42(7): 95-106.
[10]	张红斌, 尹彦, 赵冬梅, 刘滨. 基于威胁情报的网络安全态势感知模型[J]. 通信学报, 2021, 42(6): 182-194.
[11]	张腾飞, 余顺争. 移动设备加密流量的用户信息探测研究展望[J]. 通信学报, 2021, 42(2): 154-167.
[12]	程旭, 王莹莹, 张年杰, 付章杰, 陈北京, 赵国英. 基于空间感知的多级损失目标跟踪对抗攻击方法[J]. 通信学报, 2021, 42(11): 242-254.
[13]	黄韬, 刘江, 汪硕, 张晨, 刘韵洁. 未来网络技术与发展趋势综述[J]. 通信学报, 2021, 42(1): 130-150.
[14]	罗智勇,杨旭,刘嘉辉,许瑞. 基于贝叶斯攻击图的网络入侵意图分析模型[J]. 通信学报, 2020, 41(9): 160-169.
[15]	吴武飞,李仁发,曾刚,谢勇,谢国琪. 智能网联车网络安全研究综述[J]. 通信学报, 2020, 41(6): 161-174.