主動式偵測DGA Domain Flux殭屍網路惡意網域機制之研究

A Study on Proactive Mechanisms Against DGA Domain-Flux Malware for Botnet

蔡秉澂(Ping-Chang Tsai)

指導教授 ： 邵敏華

國立屏東科技大學/管理學院/資訊管理系所/碩士(2015年)

https://doi.org/10.6346/NPUST.2015.00284

摘要

歷年來的網路犯罪有許多是殭屍網路所為，殭屍網路是一群被殭屍病毒感染的電腦，平日仍然正常運作，必要時可接受駭客命令集體發動攻擊。如DDOS阻斷服務攻擊、散發垃圾郵件等。最近幾年殭屍網路的架構與手法不斷更新以逃避資安人員的追蹤，甚至運用Fast-Flux的技術發展出可以不斷變換IP位址的匿跡方法。也使得封鎖IP的方法失效，有些
殭屍網路更進一步搭載更新的功能網域產生演算法(Domain Generation Algorithm,DGA)用以快速變動網址，更讓封鎖網址的方法無用武之地。本研究實際植入具有DGA功能的病毒，並提出一個偵測法，分析DGA行為模式，藉由連線資料及系統事件之比對，找出並終止系統中的DGA演算法，並同時篩選出黑名單提供給網路設備防護之用。由實驗結果證實本論文之方法的確能測知DGA演算法並且使其停止運作，以達到早期防禦，保障使用者連線安全之功能。

關鍵字

殭屍網路 ； 網域產生演算法

並列摘要

There is a lot of cybercrime caused by Botnet over the years. The Botnet is a group of computers infected by bot virus. Victims are still running until they receiving the command from the hacker. For example, DDOS (Distributed denial of service attacks) and spamming. To avoid the track from information security administrator, the Botnet architecture and technology are continually updated and developed The purpose of Fast-Flux technology is to change IP addresses. It makes the way of blockade IP approach method failed. Some Botnets further equipped with the updated features domain generation algorithm (Domain Generation Algorithm, DGA) for rapidly changes of URLs in order to lead the URL blocking method more useless. In this research, we embed virus including of DGA function and proposed a method to deal with the attacks. We also analyze patterns of DGA behaviors from the connection data over network and therefore terminate the DGA behaviors. We also screened blacklist to the network equipment protection purposes. As a result, we conducted the experimental method, it can reliably detect patterns of the DGA behaviors and stop operations in order to achieve an early defense and protect the user's connection security.

並列關鍵字

Botnet ； DGA Domain-Flux

參考文獻

[12]Guofei Gu, Phillip Porras, Vinod Yegneswaran, Martin Fong,

[22]W. T. Strayer, D. Lapsely, R. Walsh and C. Livadas,“Botnet

[24]Zou, C.C. and Cunningham, R.,“Honeypot-Aware Advanced

is my botnet: analysis of a botnet takeover, Proceedings of

the 16th ACM conference on Computer and Communication