以行為模型為基礎之P2P Bots偵測

殭屍網路為目前資訊安全的重大威脅之一，使用者的電腦在被植入Bot之後成為攻擊者的魁儡，攻擊者可操控殭屍網路進行竊取個人資料、DDoS(分散式阻斷服務攻擊)、散布大量垃圾郵件等惡意行為。目前對於集中式的殭屍網路已經有相當多的討論，分散式的殭屍網路較少，但分散式的殭屍網路已經有發展開的趨勢，因此加強對分散式殭屍網路的研究與防禦機制是有必要的。分散式的殭屍網路並沒有一個中央控制的伺服器，每一個成為殭屍網路的節點皆是伺服器端也是客戶端，這與常見的集中式管理有相當大的不同，因此原先集中式的偵測手法要做改變，需要更多的研究來阻止這類型的惡意程式擴張。P2P Bots為攻擊者使用眾多Bots中的其中一種，它具有P2P分散式架構的特性並與一般P2P軟體流量混合在一起，因此我們藉由觀察分析P2P軟體的封包，辨別正常P2P軟體與P2P Bot之間相異之處，建立起正常的P2P行為模型，將主機端流量與模型做比對，判斷主機端是否感染P2P Bot。

關鍵字

入侵偵測；殭屍網路； P2P bot

並列摘要

Botnet has become one of the primary threats to the security of cyberspace. Comprised computers implanted with bot malwares are controlled by bot herders to launch all kinds of cyber attack. In recent years, the operation model of botnet control has evolved from the centralized IRC or HTTP botnets to the decentralized P2P botnet. Botnets adopting the new P2P communication model allow bot herders the capability to deliver attack command from any node in a P2P botnet. Hence, the existing botnet detection or defense mechanisms based on the centralized operation model are not effective in deterring the threats resulted from P2P botnet. New detection mehtod for P2P botnet is in demand. With the assistance of the existing mechanism capable of recognizing P2P network flows from other types of network traffic, the remaining task of distinguishing P2P botnet communication from legitimate P2P applications can be carry out by establishing network flow models of legitimate P2P applications and conduct a runtime verification against all P2P communication flows. In this study, the set of characteristic descriptors which can be used to serve the purpose are idetified. Model values of the characteristic descriptors of legitimate P2P applications are obtained through analysis of network flows.

並列關鍵字

P2P Botnet，Botnet detection ； Intrusion Detection ； Intrusion Defense System

參考文獻

[2] 劉邦威， ” P2P殭屍網路之適應性防禦機制”，中原大學研究所，碩士論文，中華民國九十八年一月。

[9] Phillip Porras, Hassen Saidi, and Vinod Yegneswaran, "A Multi-perspective Analysis of the Storm(Peacomm) Worm", SRITechnical-Report-10-01,Cyber-Threat Analytics(Cyber-TA),October7,2007, http://www.cyber-ta.org/pubs/StormWorm/SRITechnical-Report-10-01-Storm-Analysis.pdf

[15] Joe Stewart, “Phatbot Trojan Analysis",

參考文獻

Google Scholar

[1] Julian B. Grizzard, Vikram Sharma, Chris Nunnery, Brent Byung Hoon Kang, and David Dagon, "Peer-to-Peer Botnets: Overview and Case Study", Proceedings of Hot Topics in Understanding Botnets(HotBots’07), Usenix Assoc, April 10, 2007, http://www.usenix.org/events/hotbots07/tech/full_papers/grizzard/grizzard.pdf

Google Scholar

國際替代計量

以行為模型為基礎之P2P Bots偵測

未授權

主題瀏覽