流量自适应的移动僵尸网络云控机制研究

doi:10.11959/j.issn.1000-436x.2014.11.004

Abstract

Abstract:

Botnet is a serious attack evolved from traditional malwares.With the rapid development of computing capability and mobile Internet access technology，building a realistic mobile botnet has become a potential threat.An adaptive traffic control mechanism for cloud-based mobile botnet was proposed.It adopts different traffic consumption strategies according to different 3G or Wi-Fi network environments.Then scheduling algorithms to execute botnet commands was applied.The experimental results show the traffic adaptive algorithm can improve the stealthy and efficiency of mobile botnet while ensure that the botnet commands can be executed effectively.

Key words: mobile botnet, command and control, smart phone, scheduling algorithm, cloud-based control

Wei CHEN,Shi-wen ZHOU,Cheng-yu YIN. Research on cloud-based traffic adaptive command and control method for mobile botnet[J]. Journal on Communications, 2014, 35(11): 32-38.

Figures/Tables 10

References 15

[1]	APVRILLE A . Symbian worm Yxes:towards mobile botnets[J]. Journal in Computer Virology， 2012，8(4): 117-131.
[2]	SCHMIDT A D ， SCHMIDT H G ， BATYUK L ，et al. Smartphone malware evolution revisited:android next target?[A]. Proceeding of 4th International Conference on Malicious and Unwanted Software (MALWARE)[C]. Piscataway，NJ，USA， 2009. 1-7.
[3]	PORRAS P ， SAIDI H ， YEGNESWARAN V . An analysis of the iKee B iPhone botnet[A]. Proceedings of the 2nd International ICST Conference on Security and Privacy on Mobile Information and Communications Systems (Mobisec)[C]. Piscataway，NJ，USA， 2010. 141-152
[4]	CUI X ， FANG B ， YIN L ，et al. Andbot:toward sadvancedmo bilebotnets[A]. Proceedings of the 4th USENIX Conference on Large-Scale Exploits and Emergent Threats[C]. 2011. 11.
[5]	ZENG Y ， SHIN K G ， HU X . Design of SMS commanded-and-controlled and P2P-sructured mobile botnets[A]. Proceedings of the Fifth ACM Conference on Security and Privacy in Wireless and Mobile Networks[C]. New York，NY，USA， 2012. 137-148.
[6]	WANG P ， SPARKS S ， ZOU C C . An advanced hybrid peer-to-peer botnet[J]. IEEE Transactions on Dependable and Secure Computing， 2010，7(2): 113-127.
[7]	MULLINER C ， MILLER C . Fuzzing the phone in your phone[EB/OL]. .
[8]	MULLINER C ， SEIFERTJ P . Rise of the iBots:owning a telco network[A]. Proceedings of the 5th IEEE International Conference on Malicious and Unwanted Software (Malware)[C]. Nancy，France， 2010. 71-80.
[9]	SINGH K ， SRIVASTAVA A ， GIFFIN J ，et al. Evaluating email’s feasibility for botnet command and control[A]. Proceedings of IEEE International Conference on Dependable Systems and Networks (DSN)[C]. NJ，USA， 2008. 376-385.
[10]	ZHAO S ， LEE P P C ， LUI J ，et al. Cloud-based push-styled mobile botnets:a case study of exploiting the cloud to device messaging service[A]. Proceedings of the 28th Annual Computer Security Applications Conference[C]. New York，NY，USA， 2012. 119-128.
[11]	CHEN W ， GONG P ， YU L ，et al. An adaptive push-styled command and control mechanism in mobile botnets[J]. Wuhan University Journal of Natural Sciences， 2013，18(5): 427-434.
[12]	GU G ， ZHANG J ， LEE W . BotSniffer:detecting botnet command and control channels in network traffic[A]. Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08)[C]. San Diego，CA， 2008.
[13]	BRODSKY B . Nonparametric Methods in Change-Point Problems[M]. The Netherlands: Kluwer Academic PublishersPress， 1993.
[14]	DONG M ， ZHONG L . Self-constructive high-rate system energy modeling for battery-powered mobile systems[A]. Proceedings of the 9th International Conference on Mobile Systems，Applications，and Services[C]. New York，NY，USA， 2011. 335-348.
[15]	GU G ， PERDISCI R ， ZHANG J . BotMiner:clustering analysis of network traffic for protocol-and structure-independent botnet detection[A]. Proceedings of USENIX Security[C]. 2008. 139-154.

Metrics

Recommended 0

No Suggested Reading articles found!

优先级（从高到低）	命令	流量消耗Ci/KB	描述
0	Get APP	0	获得手机上已安装的所有App名称
	Get Info	0	获得手机短信，联系人，IMEI号码等信息
1	SMSDoS	0	读取SMS信息，对手机联系人进行短信轰炸
	SMS-Spread	0	向联系人发送含有有效URL的短信
	GenSMS	0	产生虚假信息，对网络钓鱼很有用
	DenySMS	0	过滤掉运营商发来的提醒警告短信
	Remove	0	远程卸载应用程序
	IP	＜1K	获取手机IP，便于连接发送指令
	Sock	＜1K	打开手机Sock代理，可发送/接收透传等相关消息
	Call Home	＜1K	与一些通信信道保持连接，如HTTP，E-mail，SMS等
2	Update	1K～1M	自动更新Bot程序
	Position	＜1K	秘密报告手机的GPS位置，并上传至远程服务器
3	Download	1K～1M	通过推送收到的消息自动后台下载图片或文件（如GCM、个推等推送服务）
4	DoS	1～100K	通过QQ、微信、邮箱等方式向联系人发送大量的拒绝服务数据
5	Attacking	1K～10M	SYN Flooding等淹没攻击

网络行为	采集间隔/min	流量范围/KB
待机	15	≤100
聊天、看网页等	10	100～500
看视频、下载等	5	≥500

优先级	僵尸命令	执行频率
0	Get APP、Get Info	泊松分布（λ=15）
1	IP、Sock、Call Home	15 min
2	Update	60 min
	Position	泊松分布（λ=15）
3	Download	泊松分布（λ=15）
4	DoS	60 min
5	Attacking	1次

Research on cloud-based traffic adaptive command and control method for mobile botnet

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 10

References 15

Related Articles 15

Metrics

Recommended 0

[1]	Rui SHI, Huamin FENG, Huiqin XIE, Guozhen SHI, Biao LIU, Yang YANG. Privacy-preserving attribute ticket scheme based on mobile terminal with smart card [J]. Journal on Communications, 2022, 43(10): 26-41.
[2]	Gang LI,Zhijun WU. Task scheduling algorithm for system-wide information management based on multiple QoS constraints [J]. Journal on Communications, 2019, 40(7): 27-37.
[3]	Xiaoling YIN,Xiaojiang CHEN,Qishou XIA,Juan HE,Pengyan ZHANG,Feng CHEN. Human motion state recognition based on smart phone built-in sensor [J]. Journal on Communications, 2019, 40(3): 157-169.
[4]	Xiaodong ZANG,Jian GONG,Xiaoyan HU. Detecting malicious domain names based on AGD [J]. Journal on Communications, 2018, 39(7): 15-25.
[5]	Tao YIN,Shi-cong LI,Yu-peng TUO,Yong-zheng ZHANG. Modeling and countermeasures of a social network-based botnet with strong destroy-resistance [J]. Journal on Communications, 2017, 38(1): 97-105.
[6]	Ke LI,Bin-xing FANG,Xiang CUI,Qi-xu LIU,Zhi-tao YAN. Research on Webshell-based botnet [J]. Journal on Communications, 2016, 37(6): 11-19.
[7]	Zhi-jun WANG,Feng-ye HU,Ying-qi YIN,Xiao-lan LIU. Transmission power control and scheduling algorithm in wireless body area networks [J]. Journal on Communications, 2015, 36(10): 271-277.
[8]	. Research on cloud-based traffic adaptive command and control method for mobile botnet [J]. Journal on Communications, 2014, 35(11): 4-30.
[9]	Jian XU,Geng YANG,Zheng-yu CHEN,Hai-yong WANG,Zhen YANG. Data aggregation scheduling algorithm based on twice maximum independent set [J]. Journal on Communications, 2014, 35(1): 62-71.
[10]	Fei-long ZHAO. Low-complexity and QoS-awared scheduling algorithm for LTE [J]. Journal on Communications, 2013, 34(12): 178-184.
[11]	Lu YANG,Qing-liang WU. Self-adaptive fair scheduling algorithm in wireless network [J]. Journal on Communications, 2012, 33(1): 102-106.
[12]	Jia-hui JIN,Jun-zhou LUO,Ai-bo SONG,Fang DONG. Adaptive delay scheduling algorithm based on data center load analysis [J]. Journal on Communications, 2011, 32(7): 47-56.
[13]	Tao REN,Ju-long LAN,Hong-chao HU. Practical parallel packet switch architecture based on CIOQ [J]. Journal on Communications, 2011, 32(5): 14-21.
[14]	Ge YANG,Xiu-mei FAN. Dynamic scheduling algorithm for streaming media based on CDN [J]. Journal on Communications, 2009, 30(2): 13-47.
[15]	Jiao-long WEI,Jin HU,Wen-juan DAI,Jia-hong ZOU. Network scheduling algorithm based on Stackelberg Game with incentive strategy [J]. Journal on Communications, 2009, 30(1): 135-140.