以行為為基礎偵測異常IRC流量

Behavior-based Detection of Abnormal IRC Traffic

陳嘉玫 ； 官大智 ； 陳怡綾

《資訊安全通訊》 18卷3期 (2012/07) Pp. 32-47

https://doi.org/10.29614/DRMM.201207.0002

摘要

網路攻擊常利用殭屍網路做攻擊，它結合木馬、病毒、與蠕蟲等惡意程式的感染與攻擊功能。然而，網管或是使用者通常卻是在攻發生後才發覺異常現象，察覺可能有殭屍網路的存在。常見的殭屍網路，以IRC為基礎的殭屍網路乃利用IRC通訊管道進行殭屍網路的控制與攻擊命令之下達。由於殭屍網路在潛伏期時，網路流量與平常並無明顯差異，現今的入侵偵測系統只能於殭屍網路發動攻擊時才偵測出其活動，無法有效防禦殭屍網路。本研究透過收集並分析IRC管道之訊息內容，找出操縱者（botmaster）控制的管道特性，發展一套IRC伺服器端的異常流量偵測系統，透過分析比對正常與異常管道通訊內容的差異度、平均回應時間、以及平均訊息內容長度等，找出操縱者控制之管道，以防止操縱者利用IRC伺服器操控殭屍主機，進行攻擊，期望可以在殭屍網路發動真實攻擊之前阻止其行為，以達到事前預防之功效。本研究發現正常與惡意通訊內容確實有差異，其訊息回應時間也有差異，實驗顯示所提出的特徵可找出異常IRC管道。

關鍵字

殭屍網路 ； 惡意軟體 ； 入侵偵測

並列摘要

Botnet has often been used for attack, which combines various malicious infection and attack functionalities possessed by Trojan, virus, and worm. However, its existence is discovered by network administrator or user only after an attack has been launched. IRC-based botnet is commonly used, where the botmaster controls and commands the bots through an IRC channel. As network performs normal during its latency stage, botnet is hard to be identified. Current intrusion detection systems could identify the botnet only if it actives and could not prevent botnet effectively.In this study, IRC sniffer is deployed to collect the messages exchanged in the IRC channels and anomalous behaviors are identified to detect abnormal IRC channel in IRC server. The study found that the payload length and message response time are important features to identify anomalous IRC traffic. The experimental results show that the proposed detection mechanism can identify malicious IRC channel efficiently.

並列關鍵字

Botnet ； malware ； intrusion detection

參考文獻

IRC Normal Traffic, http://www.irclog.org

J. Soriano, “Top 8 in '08,” TrendLabs Malware Blog, http://blog.trendmicro.com/top-8-in-08/,2008

TrendMircro, “The Trend Micro 2008 Annual Threat Roundup and 2009 Forecast,”http://us.trendmicro.com/imperia/md/content/us/pdf/threats/securitylibrary/trend_micro_2009_annual_threat_roundup.pdf, 2009

V. Kamluk, “The botnet business,” Viruslist.com,http://www.viruslist.com/en/analysis?pubid=204792003, 2008

()。