基于蠕虫的大规模BotNet传播与控制研究

Study on Propagation and Control of Massive Botnet Based on Worms

BotNet是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。文章介绍了BotNet的基本定义,讨论了BotNet的传播特性,对BotNet的传播策略进行了研究,最后提出分布式BotNet协同预警模型,对BotNet的传播行为进行检测和预警,阻止了其进一步扩散。

Bomet is a novel attack strategy evolved from traditional malware forms; it provides the attackers stealthy, flexible and efficient one-to-many Command and Control mechanisms, which can be used to order an army of zombies to achieve the goals including information theft, launching distributed denial of service, and sending sparta In this paper, the concept is presented, the propagation characteristic is discussed, and the propagation policy of bomet is discussed. At last a new botnet detecting model is proposed,in which botnet propagation is detected and reported,to stop its propagation.