基于智能合约的高对抗性僵尸网络研究

doi:10.11959/j.issn.2096-109x.2021070

摘要/Abstract

摘要：

区块链技术的发展与应用使构建更为鲁棒和灵活的僵尸网络命令控制信道成为可能。为了更好地研究这类潜在的新型僵尸网络威胁，提出基于区块链智能合约的高对抗性僵尸网络模型——SCBot。SCBot 模型采用分层混合拓扑结构，在僵尸子网层构建基于智能合约的命令传递信道，并建立可信度评估机制判别节点真实性，从流量和终端两大层面提升网络的对抗性。模拟构建小型的僵尸网络集群，对SCBot的命令传递效率和鲁棒性进行了对比实验，并从经济成本角度分析其在现实环境中的可行性。最后对该类型僵尸网络的防御策略做简要分析和讨论。

关键词: 网络安全, 僵尸网络, 命令控制, 区块链, 智能合约

Abstract:

The development and application of blockchain technology makes it possible to build a more robust and flexible botnet command and control channel.In order to better study this type of potential new botnet threats, a highly confrontational botnet model based on blockchain smart contracts-SCBot was proposed.The SCBot model adopts a hierarchical hybrid topology structure, builds a command transmission channel based on smart contracts at the zombie subnet layer, and establishes a credibility evaluation mechanism to determine the authenticity of nodes, and enhances the confrontation of the network from the two major levels of traffic and terminals.The construction of small botnet clusters were simulated, comparative experiments on SCBot's command transmission efficiency and robustness were conducted, and its feasibility in the real environment from the perspective of economic costs was analyzed.Finally, a brief analysis and discussion of the defense strategy of this type of botnet were given.

Key words: cyber security, botnet, command and control, blockchain, smart contract

中图分类号:

TP309

赵昊, 舒辉, 康绯, 邢颖. 基于智能合约的高对抗性僵尸网络研究[J]. 网络与信息安全学报, 2021, 7(4): 30-41.

Hao ZHAO, Hui SHU, Fei KANG, Ying XING. High resistance botnet based on smart contract[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 30-41.

图/表 13

表1

图1

图2

表2

图3

图4

表3

表4

图5

图6

表5

图7

表6

参考文献 21

[1]	BHATT P , THAKKER B . Isolating botnet attacks using bootstrap aggregating surflex-PSIM Classifier in IoT[J]. Journal of Intelligent＆ Fuzzy Systems, 2020,38(2): 1827-1840.
[2]	KEBANDE V R , VENTER H S . Obfuscating a cloud-based botnet towards digital forensic readiness[C]// 10th International Conference on Cyber Warfare and Security (ICCWS-2015). 2015.
[3]	YIN T , ZHANG Y , LI S . DR-SNBot:a social network-based botnet with strong destroy-resistance[C]// 2014 9th IEEE International Conference on Networking,Architecture,and Storage (NAS). 2014.
[4]	UNDERWOOD S . Blockchain beyond bitcoin[J]. Communications of the ACM, 2016,59(11): 15-17.
[5]	LEE B , LEE J H . Blockchain-based secure firmware update for embedded devices in an internet of things environment[J]. The Journal of Supercomputing, 2017,73(3): 1152-1167.
[6]	DORRI A , STEGER M , KANHERE S S ,et al. Blockchain:a distributed solution to automotive security and privacy[J]. IEEE Communications Magazine, 2017,55(12): 119-125.
[7]	SIKORSKI J J , HAUGHTON J , KRAFT M . Blockchain technology in the chemical industry:machine-to-machine electricity market[J]. Applied Energy, 2017,195: 234-246.
[8]	WANG W , MA X . Blockchain-based botnets for command-andcontrol Resilience[J]. Botnets:Architectures,Countermeasures,and Challenges, 2019： 217.
[9]	ALI S T , MCCORRY P , LEE H J ,et al. ZombieCoin:powering next-generation botnets with bitcoin[C]// International Conference on Financial Cryptography and Data Security. 2015.
[10]	FRKAT D , ANNESSI R , ZSEBY T . ChainChannels:private botnet communication over public blockchains[C]// 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber,Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData). 2018.
[11]	CURRAN T , GEIST D . Using the bitcoin blockchain as a botnet resilience mechanism[EB].
[12]	MAJID N A I , MALAIKA A , IBRAHIM O A . Botract:abusing smart contracts and blockchains for botnet command and control[EB].
[13]	ZOHAR O . Unblockable[EB].
[14]	SWAN M . Blockchain:blueprint for a new economy[M]. Blockchain: blueprint for a new economy.O'Reilly, 2015.
[15]	LUU L , CHU D H , OLICKEL H ,et al. Making smart contracts smarter[C]// ACM Sigsac Conference. 2016: 254-269.
[16]	KAMENSKI D , SHAGHAGHI A , WARREN M ,et al. Attacking with bitcoin:using bitcoin to build resilient botnet armies[M]. Chain:Springer. 2019.
[17]	U.S.leads multi-national action against “gameover zeus” botnet and “cryptolocker” ransom ware,charges botnet administrator[SEB].
[18]	LI K , FANG B X , CUI X ,et al. Study of botnets trends[J]. Journal of Computer Research and Development, 2016,53(10): 2189-2206.
[19]	BCK L , ALEXOPOULOS N , SARACOGLU E ,et al. Assessing the threat of blockchain-based botnets[C]// 2019 APWG Symposium on Electronic Crime Research (eCrime). 2020.
[20]	ATZEI N , BARTOLETTI M , CIMOLI T . A survey of attacks on ethereum smart contracts (SoK)[C]// International Conference on Principles of Security and Trust. 2017.
[21]	DITTRICH D , . So you want to take over a botnet[C]// Proc of the 5th USENIX Workshop on Large-Scale Exploits and Emergent Threats. 2012

专用名词	定义
account	一般账户，也称为外部账户
contract account	合约账户，唯一标识一个合约
address	特指账户地址的数据类型
int，uint，string，struct	常见数据类型
mapping	用来构建“键-值对”存储的数据类型
function	合约中实现具体功能的函数模块

符号	含义
S	高可信的超级僵尸节点S，即僵尸子网的实际控制节点
Block	区块链中的区块，前后链接组成完整的区块链（图中椭圆虚线框内）
FN	维护完整区块链数据副本的节点，可称为全节点（full node）
FNB	被僵尸网络感染后成为全节点的僵尸节点，即僵尸全节点（full node bot）
LN	只维护完整区块链数据索引的节点，可称为轻节点（light node）
LNB	被僵尸网络感染后成为轻节点的僵尸节点，即僵尸轻节点（light node bot）
Cmd	由超级节点 S 转发的来自僵尸控制者的攻击命令或控制指令
Msg	各僵尸节点（FNB和LNB）向僵尸控制者上报的节点状态信息或攻击执行反馈
回传信道	由僵尸节点向僵尸控制节点S回传数据的通信信道

序号	变量或函数名	解释说明
1	command	传递具体命令的结构体变量，由2,3,4组成
2	attack	string类型，表示攻击方式，如syn flood、http get
3	target	string类型，表示攻击目标的地址或域名
4	duration	string类型，表示攻击活动的持续时间
5	botmaster	address类型，表示僵尸网络控制者账户地址，即S节点的账户
6	contractAddress	address类型，表示合约账户地址
7	toAllBots	command结构体类型，表示广播给全体僵尸节点的命令
8	singleBot	command结构体类型，表示单播给指定僵尸节点的命令
9	botnetChannel(address b)	合约构造函数，指定合约发起者
10	newContractAddress(address n)	合约地址更新函数
11	getContractAddress()	合约地址获取函数
12	sendCommandtoAllBots(string a, string t, string d)	广播命令发送函数，函数运行后会先验证调用者身份，确认命令真实性
13	sendCommandtoSingleBot(string a, string t, string d, address s)	单播命令发送函数，函数运行后会先验证调用者身份，确认命令真实性
14	getCommand_all( )	广播命令获取函数
15	getCommand_single( )	单播命令获取函数

类别A	指标a	权重w
	a₁₁：检查ping程序的返回结果（蜜罐中往往返回相同结果）	w₁₁
A₁（默认配置）	a₁₂：检查常见用户名口令是否能够登录	w₁₂
	a₁₃：检查主机名是否正常	w₁₃
	a₁₄：检查Telnet、OpenSSH、Apache等软件版本	w₁₄
	……	…
	a₂₁：检查常见 Linux 命令行操作（如“cd ～/，$?”）的执行结果	w₂₁
A₂（系统指令）	a₂₂：检查循环结构指令的执行结果（蜜罐中会报错）	w₂₂
	a₂₃：检查带选项（如 -help）的命令行操作结果	w₂₃
	……	…
	a₃₁：检查网络时延	w₃₁
	a₃₂：检查系统组件调用的时延	w₃₂
A₃（异常行为）	a₃₃：检查端口开放数量（正常系统一般不超过5个）	w₃₃
	a₃₄：检查重新连接前后创建的文件是否仍然存在	w₃₄
	a₃₅：检查监控软件标志	w₃₅
	……	…

规模/台		传达率
规模/台	Gnutella	OP_RETURN	SCBot
100	75.0%	56.0%	51.0%
200	81.5%	72.5%	67.0%
300	90.3%	89.7%	82.3%
400	96.4%	93.2%	89.5%