應用頻率分析發掘殭屍電腦連線溝通行為

Frequency Analysis to Discover Botnet Beacon Communication Behavior

涂堂楨(Tang-Chen Tu)

指導教授 ： 賴錦慧

中原大學/商學院/資訊管理研究所/碩士(2019年)

https://doi.org/10.6840/cycu201900249

摘要

近年來，殭屍網絡威脅繼續成為各種規模組織的一個日益重要的優先事項。設計殭屍網路的惡意軟件越來越複雜，且其相應的通信行為也越不明顯，所以要找出殭屍網路越來越不易。本文介紹了網路流量的圖像化分析，作為識別隱藏在Internet中的惡意軟件溝通行為偵測的框架。在這項研究中，我們使用一些方法架構將流量壓縮轉化成圖形，然後採用機器學習演算法比對流量資料以發現信標的行為，其中信標行為是自動通信軟體中的一個重要特徵要素。由於受感染設備中的惡意軟體會定期向命令和控制服務器（C＆C）報告需要持續連線的行為，因此本文提出的想法及作為主要是收集流量並通過自動學習算法中的卷積神經網路發現網路流量中的信標現象。這篇研究提出了一個分析框架進行驗證，該框架考慮了不同時間視窗的各種信標率。在實驗數據或是真實資料中，實驗結果驗證了此模式具有顯著的性能及正確度，在專家驗證也發現實驗數據產出的資料結果經比對相關分析紀錄確實發現部分IP屬於高度危險的等級。在真實環境數據的分析結果也直接的發現部分惡意程序存在有惡意信標行為。

關鍵字

殭屍網路 ； 流量分析 ； 命令和控制服務器 ； 視覺化頻率分析 ； 卷積神經網路 ； 資訊安全

並列摘要

Botnet threats continue to be a growing priority for organizations of all sizes in recent years. The designed malware of botnet is sophisticated and the corresponding communication behavior is inconspicuous. This paper introduces Visualize Intelligence and Temporal Analysis to network traffic as a framework to identify malware behavior hidden on the Internet. In this research, we condense traffic into a graphic and then utilize machine-learning algorithm to locate the behavior of beacon (BoB), which is a vital indication of auto-communication software. Since the malware within a compromised device will report to Command & Control (C&C) server periodically, the purpose of this research is to collect traffic flow and to discover the BoB by auto-learning algorithms, such as Artificial Neural Network. Our study confirms this framework model has exceptional performance and accuracy, as well as pinpointed the live beacon during investigation. Our study presents an analytical framework which takes into account the various beacons rate during the different time period. Extensive experimental result validates that framework has significant performance.

並列關鍵字

BotNet ； Network Traffic Analysis ； Control and Command Server ； CNN ； VGG ； Information Security

參考文獻

[1]P. Amini, M. A. Araghizadeh, and R. Azmi, “A survey on botnet: classification, detection and defense,” in International Electronics Symposium (IES), United States, pp. 233-238, 2015.

[2]B. AsSadhan, A. Bashaiwth, J. Al-Muhtadi, and S. Alshebeili, “Analysis of P2P, IRC and HTTP traffic for botnets detection,” Peer-to-Peer Networking and Applications, vol. 11, no. 5, pp. 848-861, 2018.

[3]P. Barford, and V. Yegneswaran, "An inside look at botnets," Malware Detection, pp. 171-191: Springer, Boston, MA, 2007.

[4]I. A. Basheer, and M. Hajmeer, “Artificial neural networks: fundamentals, computing, design, and application,” Journal of microbiological methods, vol. 43, no. 1, pp. 3-31, 2000.

[5]L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi, “EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis,” in NDSS Symposium 2011, California, 2011.