Increasing time-spent online has amplified users' exposure to the threat of information leakage.Although existing security systems(such as firewalls and intrusion detection systems) can satisfy most of the securit...Increasing time-spent online has amplified users' exposure to the threat of information leakage.Although existing security systems(such as firewalls and intrusion detection systems) can satisfy most of the security requirements of network administrators,they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users' private information.This paper focuses on a network behavior-based method to address the limitations of the existing protection systems.At first,it analyzes the normal network behavior pattern over HTTP traffic and select four features.Then,it presents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism.It also uses real-world data to validate that the selected features are useful.The experiments have demonstrated that the model could achieve over 93%hit-rate with only about 3%falsepositive rate.It is regarded confidently that the approach is a complementary technique to the existing security systems.展开更多
为打击僵尸网络,保障网络空间安全,提出一种新型的具备强抗毁性的社交僵尸网络(DR-SNbot),并给出了针对性的防御方法。DR-SNbot基于社交网络搭建命令与控制服务器(C&C-Server,command and control server),每个C&C-Server对应...为打击僵尸网络,保障网络空间安全,提出一种新型的具备强抗毁性的社交僵尸网络(DR-SNbot),并给出了针对性的防御方法。DR-SNbot基于社交网络搭建命令与控制服务器(C&C-Server,command and control server),每个C&C-Server对应一个不同的伪随机昵称,并利用信息隐藏技术将命令隐藏在日志中发布,进而提出一种新型的命令与控制信道。当C&C-Server不同比例地失效时,DR-SNbot会发出不同等级的预警,通知攻击者构建新的C&C-Server,并自动修复C&C通信以保障其强抗毁性。在实验环境中,即使当前C&C-Server全部失效,DR-SNbot仍能在短期内修复C&C通信,将控制率维持在100%。最后,基于伪随机僵尸昵称与合法昵称在词法特征上的差异性,提出一种僵尸昵称检测方法,可有效检测社交僵尸网络利用自定义算法批量生成的伪随机僵尸昵称。实验结果表明,该方法召回率达到93%,准确率达到96.88%。展开更多
基金Supported by the National Natural Science Foundation of China(No.61070185,61003261)the Knowledge Innovation Program of the Chinese Academy of Sciences(No.XDA06030200)
文摘Increasing time-spent online has amplified users' exposure to the threat of information leakage.Although existing security systems(such as firewalls and intrusion detection systems) can satisfy most of the security requirements of network administrators,they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users' private information.This paper focuses on a network behavior-based method to address the limitations of the existing protection systems.At first,it analyzes the normal network behavior pattern over HTTP traffic and select four features.Then,it presents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism.It also uses real-world data to validate that the selected features are useful.The experiments have demonstrated that the model could achieve over 93%hit-rate with only about 3%falsepositive rate.It is regarded confidently that the approach is a complementary technique to the existing security systems.
文摘为打击僵尸网络,保障网络空间安全,提出一种新型的具备强抗毁性的社交僵尸网络(DR-SNbot),并给出了针对性的防御方法。DR-SNbot基于社交网络搭建命令与控制服务器(C&C-Server,command and control server),每个C&C-Server对应一个不同的伪随机昵称,并利用信息隐藏技术将命令隐藏在日志中发布,进而提出一种新型的命令与控制信道。当C&C-Server不同比例地失效时,DR-SNbot会发出不同等级的预警,通知攻击者构建新的C&C-Server,并自动修复C&C通信以保障其强抗毁性。在实验环境中,即使当前C&C-Server全部失效,DR-SNbot仍能在短期内修复C&C通信,将控制率维持在100%。最后,基于伪随机僵尸昵称与合法昵称在词法特征上的差异性,提出一种僵尸昵称检测方法,可有效检测社交僵尸网络利用自定义算法批量生成的伪随机僵尸昵称。实验结果表明,该方法召回率达到93%,准确率达到96.88%。
