針對無母音惡意域名之語彙特徵辨識模型

Botnet 主要是依靠網路域名來和底下眾多的Bot程式連線。當受到新興的水坑式攻擊(watering hole)時，被害者電腦會向Command & Control Server(C&C Server)，透過攻擊者申請的惡意域名，自動下載最新的惡意程式。因此，惡意域名的辨識對於Botnet防禦非常重要。一旦Botnet結構內惡意域名失效，攻擊者將無法透過C&C Server 遙控被害者電腦。為了偵測惡意域名，尤其較難偵測的不含母音的域名，我們提出以新的語彙分析和字母分析分析Botnet惡意域名與正常域名的差異，建立以白名單為基礎的語彙特徵。利用擷取的語彙特徵，以不同特徵組合的方式找出最適合訓練辨識模型的語彙特徵組合。其次再以此特徵組合進行決策樹演算模型的建立，並評估其辨識惡意域名能夠達到的效果。實驗結果顯示誤報率與漏報率可同時低於5%，因此新的語彙特徵可對於無母音的惡意域名辨識有良好的效果。

關鍵字

語彙分析；域名分析；字母分析； Botnet

並列摘要

Botnets generally use a domain name rather than actual IP address to connect its subordinated bot programs. The latest “watering hole attack” enables the botnet to propagate itself not only passively but actively. As the victim’s computer visits some webpages which contain malicious files, the victim is redirected to the C&C server and automatically downloads the newest version of malware. A botnet master, the owner and administrator of it, typically registers many a domain name of random string for their C&C server, so it is a low-cost strategy to defense against botnet by way of identifying malicious domains by their names. Once the connections to the C&C server are blocked, the botnet master can no longer control the victim computers remotely. To detect malicious domain names, especially for those without vowels, a new lexical analysis is developed in this essay with an aim to distinguishing malicious domains from normal ones and to establishing a database of lexical features based on the whitelist. Among every combination of those lexical features, the most suitable one for training is filtered out to create a decision tree model, and its effectiveness of identification is evaluated later. The result shows that both the false positive rate and false negative rate are below five percent, indicating the new lexical analysis can effectively detect malicious domain names without vowels.

並列關鍵字

lexical analysis ； consonant analysis ； Botnet ； domain name analysis

參考文獻

[1] J. Nazario, and T. Holz, “As the net churns: Fast-flux botnet observations,” International Conference on Malicious and Unwanted Software, pp: 24-31, 2008.

[7] E. Alomari, S. Manickam, B. B. Gupta, P. Singh, and M. Anbar, “Design, deployment and use of HTTP-based botnet (HBB) testbed,” International Conference on Advanced Communication Technology (ICACT), pp 1265- 1269, 2014

[8] Z. Junjie, R. Perdisci, L. Wenke, L. Xiapu, and U. Sarfraz, “Building a Scalable System for Stealthy P2P-Botnet Detection,” IEEE Transactions on Information Forensics and Security, 9(1), pp. 27-38, 2014

[9] A. Shahrestani, M. Feily, M. Masood, and B. Muniandy, “Visualization of invariant bot behavior for effective botnet traffic detection,” International Symposium on Telecommunication Technologies(ISTT), pp. 325-330, 2012

[11] G. Gu, J. Zhang, and W. Lee, “BotSniffer: Detecting botnet command and control channels in network traffic,” Network and Distributed System Security Symposium, 2008

國際替代計量

針對無母音惡意域名之語彙特徵辨識模型

未授權

主題瀏覽