【作者】 韩心慧； 郭晋鹏； 周勇林； 诸葛建伟； 曹东志； 邹维；

【Author】 Han Xinhui~1 Guo Jinpeng~1 Zhou yonglin~2 Zhuge Jianwei~1 Cao Dongzhi~1 Zou (1.Institute of Computer Science and Technology,Peking University,Beijing,100871) (2.National Computer network Emergency Response technical Team/Coordination Center of China,Beijing,100029)

【机构】 北京大学计算机科学技术研究所； 国家计算机网络应急技术处理协调中心；

【摘要】 僵尸网络已经成为网络攻击者首选的攻击平台,用以发起分布式拒绝服务攻击、窃取敏感信息和发送垃圾邮件等,对公共互联网的正常运行和互联网用户的利益造成了严重的威胁。较大规模地发现和监测实际僵尸网络的活动行为,并对其规律进行深入调查分析是进一步更为全面地监测和反制僵尸网络的必要前提。本文对1,961个实际僵尸网络的活动行为记录进行了深入调查和分析,给出了僵尸网络捕获趋势、控制服务器分布、僵尸网络规模与被控主机分布、僵尸网络各种攻击行为的分析结果。更多还原

【Abstract】 Botnets have became the first-choice attack platform for the network attackers, to launch distributed denial of service attacks, steal sensitive information and send send spams.They have raised serious threats to the normal operation of the public Internet and the benefits of the Internet users.Discovery and deep investigation on the wild botnets activities is the necessary precondition for the further global botnets measurement and disruption.Based on the investigation and analysis on tracking records of 1,961 wild botnets, this paper shows the statistical results of botnet activities, including botnet discovery trends, command and control channel distribution, botnet size and end-host distribution, and various types of botnet attack activities.更多还原