使用OpenFlow Switch分析偵測殭屍網路

Botnet Traffic Analysis and Dectection by Using OpenFlow Switch

黃勝獅(Sheng-shi Huang)

指導教授 ： 曾黎明

國立中央大學/資訊電機學院/資訊工程學系/碩士(2011年)

摘要

殭屍網路，又稱魁儡網路，病毒會隨著e-mail、網址、通訊軟體、隨身碟及電腦漏洞，侵入電腦，並偽裝成一般的程式，使用者電腦通常在不知情的狀況下感染，電腦被感染後，會主動與駭客所設置的控制伺服器連線，當建立完連線之後，駭客就可以透過遠端遙控並從事惡意的行為。
殭屍網路早期主要是透過IRC通訊協定來作溝通，但由於其之前太過普及，大部分的公司都會直接將此通訊協定擋在防火牆之外，為了穿越防火牆，許多殭屍網路進而轉以HTTP及P2P協定來作溝通，本篇以HTTP的botnet病毒為研究重心，透過使用史丹佛大學開發的NetFPGA 搭配openflow switch的平台，藉其擁有快速導向的功能及虛擬網路的優點，可實際分析電腦感染後的行為，並將HTTP based 殭屍網路的控制方法找出，透過openflow switch的協助，通知受感染的使用者解毒，阻斷其與駭客之間的聯繫。

關鍵字

OpenFlow Switch ； 殭屍網路 ； 網路安全

並列摘要

Botnet, also known as Zombie Network. Virus with the e-mail, website, communication software, USB device and computer vulnerabilities, hacking the computers and disguising as ordinary program, computer users often unknowingly infected. If the computer is infected as a botnet member, the victim computer will active set the hacker’s connection with Control & Command server. When the connection is set up completed, the hacker can remotely control and engage in malicious behavior.
Botnets in the early days through IRC protocol for communication, as early too popular ,most companies will directly block the protocol outside the firewall, in order to pass through the firewall, Many botnet then transferred to HTTP and P2P protocol to communicate.
This article focus on HTTP botnet virus, through the use of Stanford University developed NetFPGA with OpenFlow Switch platform, due to the OpenFlow switch has quick redirection and advantages of the virtual network, it can be the actual analysis of the behavior of infected computer and find out HTTP based botnet control methods, through OpenFlow Switch assistance ,notify the affected user ,blocking it with the link between hacker.

並列關鍵字

OpenFlow Switch ； Network security ； Botnet

參考文獻

[6] H. Binsalleeh T. Ormerod ,”On the Analysis of the Zeus Botnet Crimeware” , Privacy Security and Trust (PST), 2010 Eighth Annual International Conference, Aug. 2010, page.31-38

[11] Fabian Monrose and Andreas Terzis, ”A Multifaceted Approach to Understanding the Botnet Phenomenon” , Proceedings of the 6th ACM SIGCOMM conference on Internet measurement ACM New York, NY, USA ©2006 , ISBN:1-59593-561-4

[1] Chao Li, et. al.,”Botnet: Survey and Case Study”, 2009 Fourth Control, InternationalConference on Innovative Computing, Information and Kaohsiung,Taiwan, pp.1184-1187

[2] Thorsten Holz, Christian Gorecki “Measuring and Detecting Fast-Flux Service Networks”, 07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets

[3] SANS Institute Author Retains Fulll right“Analysis of a Simple HTTP Bot”