中心式结构僵尸网络的检测方法研究

Novel Method for Detecting Centralized Botnets

从近年发展趋势看,僵尸网络的结构正呈现多样化发展的趋势,中心式结构僵尸网络因控制高效、规模较大成为网络安全最大的威胁之一.中心式结构僵尸网络采用一对多的命令与控制信道,而且僵尸主机按照预定的程序对接收到的命令做出响应,因此,属于同一僵尸网络的受控主机的行为往往具有很大的相似性与同步性.针对中心式结构僵尸网络命令控制流量的特点,本文提出一种基于网络群体行为特点分析的检测方法并用于僵尸网络的早期检测与预警.实际网络流的实验表明,本方法能够有效检测当前流行的中心式结构僵尸网络.

Botnet is a novel attack strategy evolved from traditional malware forms and imposes a serious threat on the network security.Especially,most of the existing botnets employ the centralized architecture which provides a simple,low-latency,anonymous and efficient real-time communication platform.The bots connect to a remote central server and wait for the commands from the botnet controller.The flows caused by the commands and the responses from the bots are generally very similar with each other and synchronous in time,because of the limited set of the commands and the programmed responses of the bots.The main contribution of this study is the development of a common detection mechanism aiming at the centralized botnets by monitoring the global correlated behaviors embedded in the command and control（CC） traffic.By conducting an experiment with real traffic data,it shows that this method is efficient in detecting the prevalent centralized botnets.