摘要
僵尸网络发起的分布式拒绝服务攻击、垃圾邮件发送以及敏感信息窃取等恶意活动已经成为网络安全面临的重要威胁。命令与控制信道正是僵尸网络操纵这些恶意活动的唯一途径。利用命令与控制信道中攻击命令具有相对固定的格式和命令字的特点,基于现有的特征提取技术,针对边缘网络的可疑流量,提出了一个新型的特征提取模型。实验结果表明,该模型能够准确地提取出具有命令格式的特征,而且由这些特征转化的入侵检测规则能够有效识别感染的僵尸主机。
The malicious activities such as distributed denial of service attack, spam sending, and sensitive information theft launched by botnet have been the serious threats to Internet security. Command and control channel is the only way for botnet to manipulate these malicious activities. With the features of relatively fixed command format and string in the command and control channel, a novel signature generation model is proposed based on the existing techniques of signature generation, which focuses on the edge network’s suspect traffics. Experiment results show that the proposed model can generate accurate signatures conforming to the command format. Furthermore, the intrusion detection rules generated from these signatures can be used to identify the zombies effectively.
出处
《计算机工程与科学》
CSCD
北大核心
2013年第2期62-67,共6页
Computer Engineering & Science
基金
国家自然科学基金资助项目(61070200
61003303)
国家科技支撑计划资助项目(2008BAH37B03)
国家863计划资助项目(2009AA01Z432)
国家973计划资助项目(2009CB320503)
关键词
僵尸网络
网络安全
命令与控制信道
特征提取
入侵检测
botnet
network security
command and control channel
signature generation
intrusion detection