Research on Webshell-based botnet

Ke LI; Bin-xing FANG; Xiang CUI; Qi-xu LIU; Zhi-tao YAN

doi:10.11959/j.issn.1000-436x.2016118

您当前的位置：

首页 >

文章列表页 >

Research on Webshell-based botnet

Papers | 更新时间：2024-06-05

- Research on Webshell-based botnet
- Journal on Communications Vol. 37, Issue 6, Pages: 11-19(2016)
- 作者机构：
  
  1. 北京邮电大学计算机学院，北京 100876
  2. 中国科学院信息工程研究所，北京 100093
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61303239);The National High Technology Research and Development Program(863 Program)(2012AA012902)
- DOI：10.11959/j.issn.1000-436x.2016118
  CLC： TP309.5
- Online First：2016-06，
  
  Published：25 June 2016
- 稿件说明：
移动端阅览
Ke LI, Bin-xing FANG, Xiang CUI, et al. Research on Webshell-based botnet[J]. Journal on Communications, 2016, 37(6): 11-19.
DOI：

Ke LI, Bin-xing FANG, Xiang CUI, et al. Research on Webshell-based botnet[J]. Journal on Communications, 2016, 37(6): 11-19. DOI： 10.11959/j.issn.1000-436x.2016118.

摘要

以Web服务器为控制目标的僵尸网络逐渐兴起，传统命令控制信道模型无法准确预测该类威胁。对传统Webshell控制方式进行改进，提出一种树状拓扑结构的信道模型。该模型具备普适和隐蔽特性，实验证明其命令传递快速可靠。总结传统防御手段在对抗该模型时的局限性，分析该信道的固有脆弱性，提出可行的防御手段。

Abstract

With the rapid rising of Web server-based botnets

traditional channel models were unable to predict threats from them.Based on improving traditional Webshell control method

a command and control channel model based on tree structure was proposed.The model was widely applicable and stealthy and the simulation experimental results show it can achieve rapid and reliable commands delivery.After summarizing the limitations of current defenses against the proposed model

the model’s inherent vulnerabilities is analyzed and feasible defense strategies are put forward.

关键词

Keywords

references

CUI X , FANG B X , et al . Botnet triple-channel model:towards resilient and efficient bidirectional communication botnets [M ] // Security and Privacy in Communication Networks . Springer International Publishing , 2013 .

SHAHID K , et al . A taxonomy of botnet behavior,detection,and defense [J ] . Communications Surveys ＆Tutorials,IEEE , 2015 , 16 ( 2 ): 898 - 924 .

HEILMAN E , KENDLER A , ZOHAR A , et al . Eclipse attacks on Bitcoin’s peer-to-peer network [C ] // 24th USENIX Security Symposium (USENIX Security 15) . 2015 : 129 - 144 .

CANALI D , BALZAROTTI D . Behind the scenes of online attacks:an analysis of exploitation behaviors on the Web [C ] // 20th Annual Network＆Distributed System Security Symposium(NDSS 2013) . 2013 .

Netcraft . Web server survey [EB/OL ] . http://news.netcraft.com/archives/2015/11/16/november-2015-web-server-survey.html http://news.netcraft.com/archives/2015/11/16/november-2015-web-server-survey.html .

Symantec . 2015 Internet security threat report [EB/OL ] . https://www.symantec.com/security_response/publications/threatreport.jsp https://www.symantec.com/security_response/publications/threatreport.jsp .

F-Secure . Backdoor:Osx/tsunami [EB/OL ] . https://www.f-secure.com/v-descs/backdoor_osx_tsunami_a.shtml https://www.f-secure.com/v-descs/backdoor_osx_tsunami_a.shtml .

New bot malware (BoSSaBoTv2) attacking Web servers discovered [EB/OL ] . https://www.trustwave.com/Resources/SpiderLabs-Blog/Honeypot-Alert--New-Bot-Malware-(BoSSaBoTv2)-Attacking-WebServers-Discovered/ https://www.trustwave.com/Resources/SpiderLabs-Blog/Honeypot-Alert--New-Bot-Malware-(BoSSaBoTv2)-Attacking-WebServers-Discovered/ .

WANG P , SPARKS S , ZOU C C . An advanced hybrid peer-to-peer botnet [J ] . IEEE Transactions on Dependable and Secure Computing , 2010 , 7 ( 2 ): 113 - 127 .

STARNBERGER G , KRUEGEL C , KIRDA E . Overbot:a botnet protocol based on Kademlia [C ] // The 4th International Conference on Security and Privacy in Communication Networks . ACM , 2008 .

HUND R , HAMANN M , HOLZ T . Towards next-generation botnets [C ] // European Conference on Computer Network Defense . IEEE , 2008 : 33 - 40 .

DOUCEUR J R . The sybil attackpeer-to-peer systems [M ] // Springer Berlin Heidelberg , 2002 : 251 - 260 .

SINGH K , SRIVASTAVA A , GIFFIN J , et al . Evaluating email’s feasibility for botnet command and control [C ] // IEEE International Conference on Dependable Systems and Networks With FTCS and DCC,IEEE , 2008 : 376 - 385 .

XU K , BUTLER P , SAHA S , et al . DNS for massive-scale command and control [J ] . IEEE Transactions on Dependable and Secure Computing , 2013 , 10 ( 3 ): 143 - 153 .

CUI X , FNAG B X , et al . Andbot:towards advanced mobile botnets [C ] // Proceedings of the 4th USENIX Conference on Large-Scale Exploits and Emergent Threats . USENIX Association , 2011 : 11 - 11 .

LEE S , KIM J . Fluxing botnet command and control channels with URL shortening services [J ] . Computer Communications , 2013 , 36 ( 3 ): 320 - 332 .

SANATINIA A , NOUBIR G . OnionBots:subverting privacy infrastructure for cyber attacks [C ] // Dependable Systems and Networks (DSN) , 2015 : 69 - 80 .

LI J , EHRENKRANZ T , KUENNING G , et al . Simulation and analysis on the resiliency and efficiency of malnets [C ] // Principles of Advanced and Distributed Simulation . IEEE , 2005 : 262 - 269 .

WANG D Y , SAVAGE S , VOELKER G M . Juice:a longitudinal study of an SEO botnet [C ] // The NDSS Symposium . 2013 .

STONE-GROSS B , COVA M , CAVALLARO L , et al . Your botnet is my botnet:analysis of a botnet takeover [C ] // The 16th ACM Conference on Computer and Communications Security . ACM , 2009 : 635 - 647 .

BIRYUKOV A , PUSTOGAROV I , WEINMANN R . Trawling for tor hidden services:detection,measurement,deanonymization [C ] // 2013 IEEE Symposium on Security and Privacy(SP) . 2013 : 80 - 94 .

Views

1984

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Botnet detection based on generative adversarial network

BotCatcher:botnet detection system based on deep learning

Modeling and countermeasures of a social network-based botnet with strong destroy-resistance

Research on cloud-based traffic adaptive command and control method for mobile botnet

Progress in research on active network flow watermark

Related Author

Yongkang JIANG

Lin WANG

Yue TAN

Futai ZOU

Qixu LIU

Xiang CUI

Binxing FANG

Di WU

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

School of Cyberspace Security, Beijing University of Posts and Telecommunications

Institute of Electronic and Information Engineering of UESTC in Guangdong

School of Cyber Security, University of Chinese Academy of Sciences

Cyberspace Institute of Advanced Technology,Guangzhou University

AI问答

⁰