P2P殭屍網路之適應性防禦機制

An Adaptive Defence Mechanism for P2P Botnet

劉邦威(Pang-Wei Liu)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2009年)

https://doi.org/10.6840/cycu200900638

摘要

殭屍網路(botnet)是網際網路安全的一大威脅，攻擊者先藉由社交工程的手法在正常使用者的電腦中植入殭屍病毒，再經由網路下達命令操控所有的受害電腦，或執行阻斷服務攻擊、或散佈垃圾郵件等進行各種的惡意行為。近年來對於具有特定控制節點的殭屍網路的防禦已發展了許多方法，但新型的P2P殭屍網路，因為任何成員都可以成為攻擊者控制整個網路的節點，既有的方法無法阻擋P2P殭屍網路進行惡意行為。因此我們提出一個P2P殭屍網路之適應性防禦機制，以多階段偵測的方式找出網域內的殭屍電腦繼而阻斷其攻擊行為，使得攻擊者無法運用網域內受害的電腦完成其惡意行為。

關鍵字

殭屍網路 ； 入侵偵測 ； 入侵防禦

並列摘要

Botnets have become major threats to the security of the Internet. By implanting malicious bots into computers owned by ordinary users through social engineering tricks, attackers are able to remotely control victim computers to carry out malicious or disturbing operations, such as DDOS attack, or spam mail delivery. Many mechanisms have been proposed to defend against botnets that are controlled through specific command nodes. The strategy adopted by these mechanisms focuses on identifying the command node and blocking messages sent from it. However, the same idea is not applicable to the recently evolved P2P botnets since any member in a P2P can take the role of a command node. Therefore, new mechanism is needed to defend against P2P botnet. In this paper, we proposed an adaptive defense mechanism against P2P botnets. Through identifying victim computers within a network environment via multistage monitoring first and with stopping potential malicious operations follows, attackers can no longer utilize victim computers to perform malicious operations.

並列關鍵字

botnet ； P2P bot ； Intrusion Detection ； Intrusion Defense

參考文獻

http://commons.wikimedia.org/wiki/File:DHT_en.svg , January 21, 2007.

Attack in P2P File Sharing Systems", Proceedings of 25th IEEE

[11] Offensive Computing, Trojan.Peacomm樣本, http://www.offensivecomputing.net/

[25] ZHUGE Jian-Wei, HAN Xin-Hui, ZHOU Yong-Lin, YE Zhi-Yuan, and ZOU Wei, "Research and Development of Botnets", Journal of Software,

[26] Yuji KUGISAKI, Yoshiaki KASAHARA, Yoshiaki HORI, and Kouichi