Modeling and countermeasures of a social network-based botnet with strong destroy-resistance

Tao YIN; Shi-cong LI; Yu-peng TUO; Yong-zheng ZHANG

doi:10.11959/j.issn.1000-436x.2017012

您当前的位置：

首页 >

文章列表页 >

Modeling and countermeasures of a social network-based botnet with strong destroy-resistance

Papers | 更新时间：2024-06-05

- Modeling and countermeasures of a social network-based botnet with strong destroy-resistance
- Journal on Communications Vol. 38, Issue 1, Pages: 97-105(2017)
- 作者机构：
  
  1. 中国科学院信息工程研究所，北京 100093
  2. 中国科学院大学，北京100049
  3. 国家计算机应急技术处理协调中心，北京 100029
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61572496);The National High Technology Research and Development Program of China(863 Program)(2013AA014703);The National High Technology Research and Development Program of China (863 Program)(2012AA012801)
- DOI：10.11959/j.issn.1000-436x.2017012
  CLC： TP393.08
- Online First：2017-01，
  
  Published：25 January 2017
- 稿件说明：
移动端阅览
Tao YIN, Shi-cong LI, Yu-peng TUO, et al. Modeling and countermeasures of a social network-based botnet with strong destroy-resistance[J]. Journal on Communications, 2017, 38(1): 97-105.
DOI：

Tao YIN, Shi-cong LI, Yu-peng TUO, et al. Modeling and countermeasures of a social network-based botnet with strong destroy-resistance[J]. Journal on Communications, 2017, 38(1): 97-105. DOI： 10.11959/j.issn.1000-436x.2017012.

摘要

为打击僵尸网络，保障网络空间安全，提出一种新型的具备强抗毁性的社交僵尸网络（DR-SNbot），并给出了针对性的防御方法。DR-SNbot 基于社交网络搭建命令与控制服务器（C＆C-Server

command and control server），每个 C＆C-Server 对应一个不同的伪随机昵称，并利用信息隐藏技术将命令隐藏在日志中发布，进而提出一种新型的命令与控制信道。当C＆C-Server不同比例地失效时，DR-SNbot会发出不同等级的预警，通知攻击者构建新的C＆C-Server，并自动修复C＆C通信以保障其强抗毁性。在实验环境中，即使当前C＆C-Server全部失效，DR-SNbot仍能在短期内修复C＆C通信，将控制率维持在100%。最后，基于伪随机僵尸昵称与合法昵称在词法特征上的差异性，提出一种僵尸昵称检测方法，可有效检测社交僵尸网络利用自定义算法批量生成的伪随机僵尸昵称。实验结果表明，该方法召回率达到93%，准确率达到96.88%。

Abstract

To defeat botnets and ensure cyberspace security

a novel social network-based botnet with strong destroy-resistance (DR-SNbot)

as well as its corresponding countermeasure

was proposed.DR-SNbot constructed command and control servers (C＆C-Servers) based on social network.Each C＆C-Server corresponded to a unique pseudo-random nickname.The botmaster issues commanded by hiding them in diaries using information hiding techniques

and then a novel C＆C channel was established.When different proportions of C＆C-Servers were invalid

DR-SNbot would send out different levels of alarms to inform attackers to construct new C＆C-Servers.Then

DR-SNbot could automatically repair C＆C communication to ensure its strong destroy-resistance.Under the experimental settings

DR-SNbot could resume the C＆C communication in a short period of time to keep 100% of the control rate even if all the current C＆C-Servers were invalid.Finally

a botnet nickname detecting method was proposed based on the difference of lexical features of legal nicknames and pseudo-random nicknames.Experimental results show that the proposed method can effectively (precision:96.88%

recall:93%) detect pseudo-random nicknames generated by social network-based botnets with customized algorithms.

关键词

Keywords

references

FABIAN M , TERZIM s . A multifaceted approach to understanding the botnet phenomenon [C ] // 2006 ACM SIGCOMM Internet Measurement Conference (IMC) . 2006 .

KWAK H , LEE C , PARK H , et al . What is twitter,a social network or a news media [C ] // 19th International Conference on World Wide Web,ACM . 2010 : 591 - 600 .

ABRAHAM S,CHENGALUR-SMITH I . An overview of social engineering malware:Trends,tactics and implications [J ] . Technology in Society , 2010 , 32 ( 3 ):18196.

LI S , YUN X , HAO Z , et al . Modeling social engineering botnet dynamics across multiple social networks [J ] . Information Security and Privacy Research , 2012 : 261 - 272 .

ATHANASOPOULOS E , MAKRIDAKIS A , ANTONATOS S , et al . Antisocial networks:turning a social network into a botnet [C ] // Information Security,ICS . 2008 : 146 - 160 .

MA X , GUAN X , TAO J , et al . A novel IRC botnet detection method based on packet size sequence [C ] // 2010 IEEE International Conference on Communications (ICC) . 2010 : 1 - 5 .

ZOU C , CUNNINGHAM R . Honeypot-aware advanced botnet construction and maintenance [C ] // Dependable Systems and Networks,2006.DSN 2006.International Conference . 2006 : 199 - 208 .

SU C , ZHANG L F , GUAN Y , et al . A framework for P2P botnets [C ] // International Conference on Communications and Mobile Computing . 2009 .

WANG P , SPARKS S , ZOU C . An advanced hybrid peer-to-peer botnet [J ] . Dependable and Secure Computing,IEEE Transactions , 2010 , 7 ( 2 ):11127.

VOGT R , AYCOCK J . Attack of the 50 foot Botnet [EB/OL ] . http://pages.cpsc.ucalgary.ca/～aycock/papers/50foot.pdf http://pages.cpsc.ucalgary.ca/～aycock/papers/50foot.pdf .

李书豪 , 云晓春 , 郝志宇 , 等 . MRRbot:基于冗余机制的多角色P2P僵尸网络模型 [J ] . 计算机研究与发展 , 2011 , 48 ( 8 ): 1488 - 1496 .

LI S H , YUN X C , HAO Z Y , et al . MRRbot:a multi-role and redundancy-based P2P botnet model [J ] . Journal of Computer Research and Development , 2011 , 48 ( 8 ): 1488 - 1496 .

HA D , YAN G , EIDENBENZ S , et al . On the effectiveness of structural detection and defense against P2P-based botnets [C ] // IEEE/IFIP International Conference on Dependable Systems ＆ Networks,2009.DSN09 . 2009 : 297 - 306 .

李跃 , 翟立东 , 王宏霞 , 等 . 一种基于社交网络的移动僵尸网络研究 [J ] . 计算机研究与发展 , 2012 , 49 ( Suppl. ): 1 - 8 .

LI Y , ZHAI L D , WANG H X , et al . Mobile botnet based on SNS [J ] . Journal of Computer Research and Development , 2012 , 49 ( Suppl. ): 1 - 8 .

KARTALTEPE E , MORALES J , XU S , et al . Social network-based botnet command-and-control:emerging threats and countermeasures [C ] // Applied Cryptography and Network Security . 2010 : 511 - 528 .

THOMAS K , NICOL D . The koobface botnet and the rise of social malware [C ] // Malicious and Unwanted Software (MALWARE),2010 5th International Conference . 2010 : 63 - 70 .

NAGARAJA S , HOUMANSADR A , PIYAWONGWISAL P , et al . Stegobot:a covert social network botnet [C ] // Information Hiding,Springer . 2011 : 299 - 313 .

CUI X , FANG B , YIN L , et al . AndBot:towards advanced mobile botnets [C ] // 4th USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’11) . 2011 .

LIU C , LU W , ZHANG Z , et al . A recoverable hybrid C＆C botnet [C ] // 2011 6th International Conference on Malicious and Unwanted Software (MALWARE) . 2011 : 110 - 118 .

YADAV S , REDDY A K K , REDDY A L , et al . Detecting algorithmically generated malicious domain names [C ] // 10th ACM SIGCOMM Conference on Internet Measurement . 2010 : 48 - 61 .

BORGELT C , KRUSE R . Induction of association rules:apriori implementation [C ] // Compstat.Physica-Verlag HD . 2002 : 395 - 400 .

Views

1369

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Progress in research on active network flow watermark

Multi-type honeypot deployment scheme based on Stackelberg game and DQN

Survey of research on Tor-based anonymous networking technologies

Domain name generation algorithm based on improved Markov chain

Research and implementation of reputation-based inter-domain routing selection mechanism

Related Author

Xiao-jun GUO

Guang CHENG

Chen-gang ZHU

Dinh-Tu TRUONG

Ai-ping ZHOU

Han Yu

Chen Yuanheng

Wang Yichuan

Related Institution

School of Computer Science and Engineering, Southeast University

School of Information Engineering, Tibet Nationalities Institute

Ministry of Education Key Laboratory of Computer Network and Information Integration, Southeast University

School of Computer Science and Engineering, Xi’an University of Technology

School of Cyberspace Security, Zhengzhou University

AI问答

⁰