P2P Bots 之適應性防禦機制

摘要現今網際網路的威脅中，殭屍網路是一種危害性極高，且感染數量逐年上升的重大威脅之一。使用者的電腦如果被植入殭屍病毒，攻擊者即可從遠端下指令給所有被植入殭屍病毒的殭屍電腦。近年來，殭屍網路的演化迅速，從集中式控制的IRC 殭屍網路、HTTP 殭屍網路演化到分散式控制的P2P殭屍網路，這樣的演進增加了偵測的難度。新型的P2P殭屍網路應用P2P的傳輸架構，使得攻擊者可以從任何一個P2P殭屍網路節點發送攻擊指令，如此一來，原先對於集中式控制的殭屍網路的偵測和防禦有良好成效的機制，不能適用於P2P傳輸架構的殭屍網路的偵測和防禦。因此，我們採用兩階段的適應性作法，針對P2P 殭屍網路設計一個防禦機制，我們的系統採用異常行為偵測的方式，經由觀察網路行為找出以P2P方式運用網路的主機程序，並監視這些程序在主機上的活動，當偵測到可判定為異常行為的活動時，即設定防火牆對所有該程序的網路埠進行阻擋。我們的作法不因殭屍病毒變種或是未知型而影響防禦的進行，根據主機上P2P 通訊的活動跡象確定需觀察的對象，由主機上的異常行為確認主機遭受P2P殭屍網路的毒害，並且準確地阻擋P2P殭屍網路與受害者的溝通管道。我們完成了這個方法的實作，驗證了這個防禦機制可行性。

關鍵字

入侵防禦系統；入侵偵測；殭屍網路偵測； P2P 殭屍網路

並列摘要

Abstract Among all the security threats in the cyberworld, botnet is one which is highly destructive and ever-increasingly populated such that an attacker can remotely control a large set of compromised computers to launch group or individual attacks against targeted or non-targeted system. In recent years, the operation model of botnet control has evolved from the centralized IRC or HTTP botnets to the decentralized P2P botnet. The change inflicted degradation in the ability to detect the existence of botnet. The new P2P botnet adopting P2P communication model allows an attacker the capability to deliver attack command from any node in a P2P botnet. Hence, the existing botnet detection or defense mechanisms based on the centralized operation model are not effective in deterring the threats resulted from P2P botnet. Therefore, we devised a 2-stage adaptive detection and defense mechanism for P2P botnet. Processes utilizing P2P communication model are identified according to their network behavior. Then, they are subjected to be monitored for all activities on host computers. When any of the designated anomaly behaviors is detected, defense mechanism, such as the activation of a firewall rule to block the traffic to or from the corresponding communication port, are employed. The proposed mechanism can perform the intended defense whether or not the bot malware is a known one, a variation or a previously unknown one. A prototype system has been implemented and the effectiveness of the proposed scheme is verified.

並列關鍵字

P2P Botnet ； Botnet detection ； Intrusion Detection ； Intrusion Defense System

參考文獻

[26] 劉邦威，“P2P殭屍網路之適應性防禦機制”，中原大學研究所，碩士論文，中華民國九十八年一月。

[3] Matt Jonkman. "Encrypted storm traffic", 2007,

[4] Jian Kang, Jun-Yao Zhang, Qiang Li, and Zhuo Li, “Detecting New P2P Botnet with Multi-chart CUSUM”, 2009 International Conference on Networks Security, Wireless Communications and Trusted Computing, 2009,

[7] Iván Arce and Elias Levy, “An analysis of the slapper worm”, IEEE Security & Privacy Magazine, vol. 1, no. 1, pp. 82–87, 2003

[8] Joe Stewart, “Sinit P2P Trojan analysis”,

國際替代計量

P2P Bots 之適應性防禦機制

全文下載

主題瀏覽