一种新颖的P2P僵尸网络检测技术

针对当前僵尸网络向P2P方向发展的趋势,在对P2P僵尸网络本质的理解和把握的基础上,提出了一种新颖的P2P僵尸网络检测技术。对于某个被监视的网络,关注其内部每台主机的通信行为和网络恶意活动。把这些通信行为和网络恶意活动分类,找出具有相似或相关通信和网络恶意行为的主机。根据我们对定义的理解,这些主机就属于某个P2P僵尸网络。     

一种新颖的P2P僵尸网络检测技术

针对当前僵尸网络向P2P方向发展的趋势,在对P2P僵尸网络本质的理解和把握的基础上,提出了一种新颖的P2P僵尸网络检测技术。对于某个被监视的网络,关注其内部每台主机的通信行为和网络恶意活动。把这些通信行为和网络恶意活动分类,找出具有相似或相关通信和网络恶意行为的主机。根据我们对定义的理解,这些主机就属于某个P2P僵尸网络。     

半分布式P2P僵尸网络的伪蜜罐检测方法

在攻击与防御的博弈中,半分布式P2P僵尸网络随着P2P的广泛应用已成为僵尸网络最主要的形式。为此,描述攻击者组建的半分布式P2P僵尸网络的构建原理和增长模型,提出蜜罐与流量分析技术相结合的“伪蜜罐”检测模型,即在主机出现网络异常时,关闭已知程序和服务,使主机向蜜罐身份靠近,并用流量分析技术检测的一种模型。实验结果表明,该检测方法能够有效地提高半分布式P2P僵尸网络的检出率。     

结构化对等网络中P2P 僵尸网络传播模型

依赖结构化对等网传播的P2P僵尸是未来互联网面临的重要威胁.详细分析了两种典型的结构化P2P协议Chord和Kademlia的工作原理,在此基础上,使用数学建模的方法建立了结构化P2P僵尸网络的传播模型.该模型将Kademlia,Chord协议与双因子免疫机制、主机在线率等因素相结合,较为全面地研究了两种典型的结构化P2P网络中僵尸的传播机理,并使用软件仿真的方法模拟了节点超过百万时,结构化P2P网络中僵尸的传播行为,通过软件仿真得出的数据与理论数据进行对比,验证了模型的正确性.从实验结果可以看出:对于Kademlia和Chord两种结构化P2P网络,僵尸传播无论是双因子免疫模型还是结合双因子与主机在线率的模型,理论模型与仿真结果都非常吻合,体现了模型的准确性,为僵尸的检测与防御提供了理论依据.     

基于域的P2P僵尸网络防御体系

针对当前传统安全技术不能对P2P环境下的僵尸网络进行有效防御的问题,在P2P僵尸网络病毒的一般性行为特征的基础上,设计了一种基于域的P2P僵尸网络的防御体系,并提出了利用僵局网络通信数据流特征向量的相似度分析解决因僵尸结点过少,无法检测出IP聚焦而无法识别僵尸结点的问题.该防御体系采用层次化结构,按P2P网络的逻辑地址段划分域,在城内采用将主机恶意行为与P2P流识别相结合的方法判别僵尸网络的通信数据流并提取特征向量.实验结果表明,该体系具有较高的性能和通用性.     

基于排列熵与决策级多传感器数据融合的P2P僵尸网络检测方法

提出了一种基于排列熵和决策级多传感器数据融合的P2P僵尸网络检测算法。首先分别构建流量异常检测传感器和异常原因区分传感器:前者利用排列熵刻画网络流量的复杂度特征(该特征并不依赖于特定类型的P2P僵尸网络),通过利用Kalman滤波器检测该特征是否存在异常;后者利用TCP流量特征在一定程度上减弱P2P应用等网络应用程序对P2P僵尸网络检测的误差影响。最后利用D-S证据理论对上述传感器的检测结果进行决策级数据融合以获得最终的检测结果。实验表明,提出的方法可有效检测新型P2P僵尸网络。     

P2P僵尸网络研究

P2P僵尸网络是一种新型网络攻击方式,因其稳定可靠、安全隐蔽的特性被越来越多地用于实施网络攻击,给网络安全带来严峻挑战.为深入理解P2P僵尸网络工作机理和发展趋势,促进检测技术研究,首先分析了P2P僵尸程序功能结构,然后对P2P僵尸网络结构进行了分类,并分析了各类网络结构的特点;在介绍了P2P僵尸网络生命周期的基础上,着重阐述了P2P僵尸网络在各个生命周期的工作机制;针对当前P2P僵尸网络检测研究现状,对检测方法进行了分类并介绍了各类检测方法的检测原理;最后对P2P僵尸网络的发展趋势进行了展望,并提出一种改进的P2P僵尸网络结构.     

基于网络层包头信息的P2P僵尸网络检测方法研究

僵尸网络作为目前重大的网络安全事件之一,正朝着P2P等分布式结构发展。迄今为止,用于检测并减轻僵尸网络效应的技术可以分为两类:基于网络的方法和基于主机的方法。分析了已有检测方法存在的不足,提出了一种基于网络层的P2P僵尸网络检测方法 ,并对这种僵尸网络检测方法的可行性和成功率等各个方面进行了深入分析和探讨。在此基础上,我们通过模拟实验对检测效果进行了分析和评估,实践表明,该方法是可行的。     

基于数据挖掘策略的P2P僵尸网络检测方法研究

僵尸网络由一群被病毒感染的计算机组成,它严重的威胁着Internet的安全。其原理是黑客把病毒植入到目标计算机,然后黑客通过Internet控制这些计算机来实施DDoS攻击、盗取认证信息、分发垃圾邮件和其他恶意行为。通过仿P2P软件,P2P僵尸网络用多个主控制器来避免单点丢失（single pointof failure）,并且使用加密技术使得各种各样的misuse detection技术失效。与正常网络行为不同的是,P2P僵尸网络建立了大量不占用带宽的会话,这就使它不会暴露在异常检测技术下。本文采用P2P僵尸网络不同于正常网络行为的特征作为数据挖掘的参数,然后对这些参数进行聚类并加以区分来获得可接受精度范围内可信任的结果。为了证明该方法在发现僵尸网络主机上的有效性,我们在实际的网络环境中进行了验证测试。     

P2P僵尸网络研究

僵尸网络是近年来网络安全最严重的威胁之一.P2P僵尸网络是在传统僵尸网络基础上发展起来的,其命令与控制机制具有隐蔽性和健壮性,使检测和防范变得更加困难.本文对P2P僵尸网络的构建、命令与控制机制、检测与反制技术进行了研究与分析.     

Scalable P2P bot detection system based on network data stream

P2P Botnets are one of the most malevolent threats to the Internet users due to their resiliency against takedown efforts. In this paper, we propose a bot detection system that is capable of detecting stealthy bots in a network. This system treats network traffic as a data stream, segregating the traffic into two parallel streams. The detection is based on failure traffic and communication traffic. The traffic is analyzed during small time window, and the infected hosts are reported immediately. The network administrator can monitor the status of hosts in the network and can take the necessary action before the infected hosts harm the system or can involve in the attacks. Experiments and evaluation of the proposed system on a variety of P2P data transfer applications and P2P botnets have demonstrated high accuracy of detection. The scalability of the proposed system is exhibited through its implementation on Hadoop MapReduce.     

A novel method of mining network flow to detect P2P botnets

Botnets are a serious threat to cyber-security. As a consequence, botnet detection has become an important research topic in network protection and cyber-crime prevention. P2P botnets are one of the most malicious zombie networks, as their architecture imitates P2P software. Characteristics of P2P botnets include (1) the use of multiple controllers to avoid single-point failure; (2) the use of encryption to evade misuse detection technologies; and (3) the capacity to evade anomaly detection, usually by initiating numerous sessions without consuming substantial bandwidth. To overcome these difficulties, we propose a novel data mining method. First, we identify the differences between P2P botnet behavior and normal network behavior. Then, we use these differences to tune the data-mining parameters to cluster and distinguish normal Internet behavior from that lurking P2P botnets. This method can identify a P2P botnet without breaking the encryption. Furthermore, the detection system can be deployed without altering the existing network architecture, and it can detect the existence of botnets in a complex traffic mix before they attack. The experimental results reveal that the method is effective in recognizing the existence of botnets. Accordingly, the results of this study will be of value to information security academics and practitioners.     

Detecting P2P botnets by discovering flow dependency in C&C traffic

Botnets are widely used by attackers and they have evolved from centralized structures to distributed structures. Most of the modern P2P bots launch attacks in a stealthy way and the detection approaches based on the malicious traffic of bots are inefficient. In this paper, an approach that aims to detect Peer-to-Peer (P2P) botnets is proposed. Unlike previous works, the approach is independent of any malicious traffic generated by bots and does not require bots’ information provided by external systems. It detects P2P bots by focusing on the instinct characteristics of their Command and Control (C&C) communications, which are identified by discovering flow dependencies in C&C traffic. After discovering the flow dependencies, our approach distinguishes P2P bots and normal hosts by clustering technique. Experimental results on real-world network traces merged with synthetic P2P botnet traces indicate that 1) flow dependency can be used to detect P2P botnets, and 2) the proposed approach can detect P2P botnets with a high detection rate and a low false positive rate.     

P2P技术在僵尸网络中的应用研究

与传统集中式僵尸网络相比,P2P僵尸网络鲁棒性更好、拓扑结构更复杂,因此更难防御。针对上述情况,将P2P网络按拓扑结构分为4类,即中心化拓扑、全分布式非结构化拓扑、全分布式结构化拓扑和半分布式拓扑。对4类P2P技术从流量、消息传播速度和网络鲁棒性3个方面进行分析比较和实验验证,并指出以半分布式结构为代表的新型P2P网络具有较好的综合性能,是未来僵尸网络的发展方向之一。     

Identifying botnets by capturing group activities in DNS traffic

Botnets have become the main vehicle to conduct online crimes such as DDoS, spam, phishing and identity theft. Even though numerous efforts have been directed towards detection of botnets, evolving evasion techniques easily thwart detection. Moreover, existing approaches can be overwhelmed by the large amount of data needed to be analyzed. In this paper, we propose a light-weight mechanism to detect botnets using their fundamental characteristics, i.e., group activity. The proposed mechanism, referred to as BotGAD (botnet group activity detector) needs a small amount of data from DNS traffic to detect botnet, not all network traffic content or known signatures. BotGAD can detect botnets from a large-scale network in real-time even though the botnet performs encrypted communications. Moreover, BotGAD can detect botnets that adopt recent evasion techniques. We evaluate BotGAD using multiple DNS traces collected from different sources including a campus network and large ISP networks. The evaluation shows that BotGAD can automatically detect botnets while providing real-time monitoring in large scale networks.     

A P2P Botnet detection scheme based on decision tree and adaptive multilayer neural networks

In recent years, Botnets have been adopted as a popular method to carry and spread many malicious codes on the Internet. These malicious codes pave the way to execute many fraudulent activities including spam mail, distributed denial-of-service attacks and click fraud. While many Botnets are set up using centralized communication architecture, the peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control data making their detection even more difficult. This work presents a method of P2P Bot detection based on an adaptive multilayer feed-forward neural network in cooperation with decision trees. A classification and regression tree is applied as a feature selection technique to select relevant features. With these features, a multilayer feed-forward neural network training model is created using a resilient back-propagation learning algorithm. A comparison of feature set selection based on the decision tree, principal component analysis and the ReliefF algorithm indicated that the neural network model with features selection based on decision tree has a better identification accuracy along with lower rates of false positives. The usefulness of the proposed approach is demonstrated by conducting experiments on real network traffic datasets. In these experiments, an average detection rate of 99.08 % with false positive rate of 0.75 % was observed.

     

Bloccess: Enabling Fine-Grained Access Control Based on Blockchain

Botnets pose significant threats to cybersecurity. The infected Internet of Things (IoT) devices are used to launch unsupported malicious activities on target entities to disrupt their operations and services. To address this danger, we propose a machine learning-based method, for detecting botnets by analyzing network traffic data flow including various types of botnet attacks. Our method uses a hybrid model where a Variational AutoEncoder (VAE) is trained in an unsupervised manner to learn latent representations that describe the benign traffic data, and one-class classifier (OCC) for detecting anomaly (also called novelty detection). The main aim of this research is to learn the discriminating representations of the normal data in low dimensional latent space generated by VAE, and thus improve the predictive power of the OCC to detect malicious traffic. We have evaluated the performance of our model, and compared it against baseline models using a real network based dataset, containing popular IoT devices, and presenting a wide variety of attacks from two recent botnet families Mirai and Bashlite. Tests showed that our model can detect botnets with a satisfactory performance.

     

基于通信流量特征的隐秘P2P僵尸网络检测

针对目前基于网络的P2P僵尸网络检测中特征建模不完善、不深入的问题, 以及僵尸网络中通信具有隐蔽性的特点, 提出一种对通信流量特征进行聚类分析的检测方法。分析P2P僵尸网络在潜伏阶段的通信流量统计特征, 使用结合主成分分析法和X-means聚类算法的两阶段聚类方法对特征数据集进行聚类分析, 进而达到检测P2P僵尸网络的目的。实验结果表明, 该方法具有较高的检测率和较好的识别准确性, 并保证了较快的执行效率。