【作者】 臧天宁；

【导师】 门朝光；

【作者基本信息】 哈尔滨工程大学 ， 计算机应用技术， 2011， 博士

【摘要】 随着互联网的广泛应用，一些恶意软件在网络上泛滥肆虐，出现了各种网络攻击和网络欺骗行为，其中僵尸程序是目前最新型恶意软件之一。攻击者利用被植入僵尸程序的受控主机构建僵尸网络，并借助这个平台在互联网上执行各种恶意行为，如发动分布式拒绝服务（Distributed Denial of Service, DDoS）攻击、发送垃圾邮件（Spam）、网络钓鱼（Phishing）以及信息窃取（Information Theft）等。攻击者通过建立命令和控制机制实现与受控主机通信，并统一管理僵尸网络成员。一个典型僵尸网络可具有数万至数十万甚至数百万台受控主机，产生巨大攻击力，消耗大量网络带宽和处理能力。僵尸网络被认为是互联网安全的最大威胁。因此，探索如何检测识别僵尸网络，有效追踪、防御、控制、减轻其危害显得尤为重要。针对这些问题，本文着重研究以下几个方面内容：首先，针对使用互联网中继聊天（Internet Relay Chat, IRC）协议和HTTP协议的集中式僵尸网络，提出基于通信流量相似性和域名查询特性的僵尸网络检测方法。在分析集中式僵尸网络通信行为特征和僵尸网络受控主机域名查询数据流群组特性的基础上引入云模型概念。定义僵尸网络通信流量相异度云模型，挖掘具有僵尸网络通信行为特性的主机组，分析该组主机访问DNS服务器的流量。通过域名访问度和DNS查询流量聚类分析，最终确定僵尸网络的受控主机。利用典型僵尸程序样本和真实背景流量评测本文方法的检测能力，并与相关工作进行比较分析，以此验证本文方法的先进性。其次，针对僵尸网络结构日趋复杂，并且不同受控主机群之间可能存在潜在隐藏关系等问题，提出僵尸网络相似度的度量方法。分析僵尸网络内部通讯的数据流数量、流中数据包数量、主机通讯量和数据包负载等特征，定义特征相似度统计函数。在此基础上，利用改进D-S证据理论融合各特征相似度，建立僵尸网络关系分析模型，以此综合评测两个僵尸网络的相似度。实验结果表明本文的方法是有效的，对于采用加密通讯僵尸网络的评测，仍表现出良好效果。并且，应用该方法对基础网络安全监测平台捕获的实际僵尸网络数据进行分析,取得了理想效果。再次，IRC僵尸网络和HTTP僵尸网络的命令与控制服务器经常发生迁移以躲避检测，针对此类问题，提出一种僵尸网络迁移识别方法。基于僵尸网络迁移过程中表现出的多种特征，采用C-F模型进行特征融合，综合分析判断给定的两批僵尸主机是否具有迁移关系。利用典型僵尸样本进行试验验证，结果显示本文方法能够有效识别僵尸网络的迁移行为。并与单纯采用IP地址重合度的方法进行对比，结果表明在僵尸网络成员数量动态变化的情况下，本文方法仍然表现出很好识别效果。最后，为了识别发现开放互联网环境中不同地理位置、不同时间段发生的安全事件之间可能存在的潜在隐藏关系，提出基于通用图灵机思想的分布式网络安全事件检测识别协同联动模型（Cooperative Work Model, CWM），并基于此模型设计实现面向基础网络的分布式网络安全事件检测识别协同联动系统（Cooperative Work System, CWS）。分析了CWM的多层体系结构，并将其与基于安全域的安全操作中心（Security OperatingSystem, SOC）模型进行对比分析。通过应用实例验证，CWS能够协调骨干网上不同类型网络设备共同工作，追踪、检测、分析、识别僵尸网络。典型数据分析结果表明，CWS不仅能够分析识别不同时间和不同空间安全事件之间关系，还能够有效支持发现各安全事件关联引起的更深层次安全隐患。本文主要研究了僵尸网络检测与识别关键技术，其中包括僵尸网络相似度度量和僵尸网络迁移行为分析，提出了协同检测识别僵尸网络方法、模型，并研发了相应系统。目的是有效的检测追踪僵尸网络和准确识别僵尸网络关系和规模，以便防控僵尸网络的危害。本文的研究成果对于僵尸网络防御技术研究具有重要理论和实践意义，也对检测防范其他分布式网络恶意事件有重要参考价值。更多还原

【Abstract】 With widespread use of Internet, some malwares are overrunning like the plagues. Thereare various kinds of attacks and fraudulent activities on the Internet, and the bot is one of themost state-of-the-art malwares. The attackers build the botnet by the compromised controlledcomputers, which are called zombies and controlled by hosted bot software. This network isthen used as a platform to conduct fraudulent activities, such as Distributed Denial of Service(DDoS) attack, spam, phishing, information theft, etc. Attackers can communicate with thebots by creating command and control mechanisms and make united management of thebotnet members. A botnet typically contains tens to hundreds of thousands of bots, but someeven have several millions of bots. With the magnitude and the potency of attacks afforded bycombined bandwidth and processing power of zombies, botnets are now considered as thelargest threat to the Internet security. Therefore, it is more important to explore how to detectand identify a botnet, effectively track, defense, control and reduce the jeopardy caused by thebotnets. To address these issues, the research work of this dissertation focuses on thefollowing aspects:Firstly, a method to detect centralized botnets adopting IRC (Internet Relay Chat) andHTTP protocols is proposed based on the similarity of communication flows and theproperties of DNS queries. On the basis of the features analysis of centralized botnetcommunication activities and the dataflow group for bots to query DNS, the concept of thecloud model is introduced. A cloud model is proposed to define the dissimilarity of the botnetcommunication flows. The group of bots, which have the features of the botnetcommunication activities, is mined. The flows of the communication between the bots and theDNSes are analyzed. By the cluster analysis of the access frequency and the data flows ofquery DNSes, the controlled computers are determined in the end. The proposed method isevaluated in terms of the detection capability by using typical botnet samples and realbackground traffic. It is also analyzed and compared with the related work. Hereby，theadvancement of this method is validated.Secondly, to address the issues caused by increasingly structural complexity andpotential implicit relationship between different botnets, the measurement approach of thebotnet similarity is proposed. The botnet features, including the dataflow number of internalcommunication, the number of data packets of the data flows, the amount of communication between bots, the payload of data packets, and so on, are analyzed. The statistical function ispresented to define the botnet feature similarity. On the basis of this work, various kinds offeatures similarity are syncretized by means of the improved D-S (Dempster-Shafer) evidencetheory. The model is set up to analyze the relationship between botnets and syntheticallyevaluate the feature similarities of two botnets. The experimental results show that thepresented approach in this dissertation is effective, and can even work well during theevaluation for the botnets with encrypted communication. Moreover, the ideal effect isachieved by applying the approach to analyze practical bonet data captured by the securitymonitoring platform of the fundamental backbone network.Thirdly, the command and control servers of the IRC botnets and the HTTP botnets areoften migrated to avoid the detection. To address this kind of issues, an approach is proposedfor identifying the migration of a botnet. Based on the multiple features appearing during themigration of a botnet, the migration relationships between two botnets are comprehensivelyanalyzed and determined by adopting the C-F model to fuse the features. Typical botnetsamples are used to conduct the evaluation experiments. The experimental results show thatproposed approach in this dissertation can effectively identify the migration activities of thebotnets. Compared with the method only using the overlap ratio of IP addresses, the presentedapproach in this dissertation still have a good identification in the case of the number of thebotnet members is dynamically changed.Finally, in order to identify the potential implicit relationship between the security eventsoccurred at different geographic positions and time in open Internet environment, aCoordinative Work Model (CWM) is proposed based on the idea of the Universal TuringMachine to detect and identify distributed network security events. Based on this model, theCoordinative Work System (CWS) is designed and implemented to detect and identify thedistributed network security events occurring in the fundamental backbone network. TheCWM is analyzed in terms of multiple-layered architecture, and compared with the SOC(Security Operating System) based model. It is validated by practical cases that CWS cancoordinate different types of network equipments in the backbone network to work togethereffectively for the track, detection, analysis, and identification of the botnets. The analysis oftypical experiment data shows that CWS is not only able to analyze and identify therelationships between the security incidents occurred at different time and space, but alsoeffectively support the discovery of deeply hidden threat against safety raised by thecorrelation between different incidents.The key technologies of the Botnet detection and identification are investigated in this dissertation, including the measurement of the Botnet similarity and the analysis of the Botnetmigration. The methods and models of coordinated detection and identification of the Botnetare presented, the corresponding systems are developed. This is intended to effectively detectand track the Botnet, and correctly identify the relationship between the Botnets and theirscales, so as to prevent and control the damage caused by the Botnets. The research results ofthis dissertation are of importantly theoretical and practical significance for the research of theBotnet defense technologies, and also have important reference value to detect and keep awayother distributed malware incidents in the Internet.更多还原