殭屍網路監控平台之開發

隨著科技創新，殭屍網路(Botnet)，為目前最新式的網路攻擊型態，其透過其電子郵件、通訊軟體、或利用電腦系統漏洞等方式，將殭屍病毒(Bot)隱藏於應用程式或網頁中，以植入受害主機，造成大量使用者主機感染形成殭屍電腦(zombie)，以執行惡意任務。每台殭屍電腦會通過特定協定，例如HTTP、SSH或 P2P與殭屍網路的控制中心建立連接，接受來自控制中心的控制指令，造成阻斷服務、濫發電子郵件甚至偷竊個人隱私資訊等網路犯罪。本研究發展一套殭屍網路之監控平台，能夠檢查遠端主機，蒐集及記錄受監控主機的感染狀況、網路流量，當受監控主機感染殭屍病毒時，進行數位解藥派送，並將解毒後的即時系統記錄回報至監控平台；若發生資安緊急情況，可遠端中斷網路連線，並發送警告訊息給網路管理者，強化網路安全防護並大幅降低網路管理的負擔。

關鍵字

殭屍網路；殭屍電腦；監控平台；網路安全

並列摘要

Nowadays, botnet has become a new type of network attack via the use of e-mail, social network or host vulnerability that downloads bots into the infected computers. As a result, many infected hosts (i.e., zombie) have been taken over by hackers in order to perform malicious tasks. Hackers used botnet to and Zombies can be manipulated by distinct protocols such as http, ssh or p2p from Command & Control center (C&C) that leads to serious threats, for example, DDOS, SPAM and steal business information. The present study develops a botent monitoring platform to check the remote hosts, collect the abnormal behaviors of zombie and monitor the network flow. When detected the malicious behaviors of bot from suspicious hosts, the platform will send the digital antidote to recover as well as report the real-time status of hosts back to the platform via system logs. Two real-cases are conducted to show that the proposed approach can effectively monitor the botnets, distribute the digital antidote and rapidly cut the inbound/outbound of network connections that enhance the network security protection and lower the loading in network management by sending the alert message to manager.

並列關鍵字

Botnet ； Zombie ； Monitoring platform ； Network security

參考文獻

[2] 王平、黃財德，“殭屍電腦偵測系統之實現”，碩士論文，崑山科技大學，2009。

[7] Rajab, M.A., et al., “A Multifaceted Approach to Understanding the Botnet Phenomenon,” Internet Measurement Conference 2006, October, 2006, pp.25-27.

[8] Barford, P. and Yegneswaran, V., “An Inside Look at Botnets,” Special Workshop on Malware Detection, Advances in Information Security, Springer Verlag, 2006.

[9] C.Kalt, “Internet Relay Chat: Architecture,” RFC 2810, 2000.

[14] Conficker, Available from: http://en.wikipedia.org/wiki/Conficker.

國際替代計量

殭屍網路監控平台之開發

未授權

主題瀏覽