僵尸网络发展研究

Study of Botnets Trends

僵尸网络(botnet)作为最有效的网络攻击平台,给当今互联网安全带来了巨大威胁.虽然近几年关于僵尸网络的攻防技术研究取得了显著进展,然而,伴随着互联网应用的多元化以及通信技术的不断革新,僵尸网络的形态和命令控制机制也在不断发生变化,这给防御人员带来了新的挑战.深入了解僵尸网络运行机理和发展趋势对有效应对僵尸网络引发的安全威胁具有重要意义.以僵尸网络攻击技术为核心,从形式化定义、传播方式、生命周期、恶意行为、命令控制信道方面对僵尸网络机理进行全面介绍,按时间顺序将僵尸网络的发展历程划分为PC攻击和广泛攻击2个阶段,对各阶段的技术特点、行为特性、代表案例以及演化规律进行详细阐述,总结当今僵尸网络防御方法和研究成果,对已有研究遗留的问题和未来可能研究热点进行讨论.

Botnets,as one of the most effective platforms to launch cyber-attacks,pose great threats to the security of today's cyber-space.Despite the fact that remarkable progress had been made in the researches of botnets'both attack and defense technologies in recent years,the forms and command and control mechanisms of botnets,however,as Internet applications are put into a wider variety of uses and communication technologies upgraded more rapidly than ever,are also undergoing constant changes,bringing new challenges to defenders.For this reason,an in-depth investigation of botnets'working mechanisms and development is of great significance to deal with the threats posed by botnets.This paper,with the attack technologies of botnets as its main focus,gives an comprehensive introduction of the working mechanisms of botnets in terms of its definition,transmission,lifecycle,malicious behaviors and command and control channels,and divides the botnets'development into two stages,namely,attacks to traditional PC and extensive attacks,with the technological features,behavioral characteristics,case studies and evolutionary patterns of each stage elaborated in a detailed manner.After a summary of existing work on the defense of botnets with the limitations of each approach discussed,possible future attempts are presented.