一种基于IRC信道控制的僵尸网络分析

The Analysis of a Zombie Network Based In IRC Protocol

分布式拒绝服务攻击利用了Tcp/Ip协议体系固有的安全漏洞,攻击方式非常有效,而且难以抵挡。因为它们产生的是合法的流量和数据请求,很难检测到真正的攻击来源。本文详细介绍了僵尸网络的工作原理。本文在实验环境下,分析了一种基于irc聊天室传播的僵尸网络,通过报文分析,提取出报文特征,根据报文特征,能够准确判断出傀儡机、控制者和IRC服务器在网络中的位置。此外,还分析了受感染主机的行为,有助于判断主机是否感染该病毒,简单介绍了清除Sdbot的方法。

Distributed denial of service attacks take advantage of the inherent security vulnerabilities of tcp/ip protocol architecture. They are very effective,and can＇t efficiently defend,because what they generated are legal and data request. This paper describes the working principle of botnets. In the simulation environment,this paper analyzes a zombie tool which spreads through the IRC chat room. We can accurately determine the zombies、the controller and the IRC server according to the message characterstic. Moreover,this paper also analyzes the behavior of the zombie host. According to the behavior,we are able to judge whether the host is infected with the virus or not. In addition,this paper provides some ways to clear the Sdbot virus.