On the resilience of P2P botnet footprints in the presence of legitimate P2P traffic

Botnet is a distributed platform for illegal activities severely threaten the security of the Internet. Fortunately, although their complicated nature, bots leave some footprints during the C&C communication that have been utilized by security researchers to design detection mechanisms. Nevertheless, botnet designers are always trying to evade detection systems by leveraging the legitimate P2P protocol as C&C channel or even mimicking legitimate peer‐to‐peer (P2P) behavior. Consequently, detecting P2P botnet in the presence of normal P2P traffic is one of the most challenging issues in network security. However, the resilience of P2P botnet detection systems in the presence of normal P2P traffic is not investigated in most proposed schemes. In this paper, we focused on the footprint as the most essential part of a detection system and presented a taxonomy of footprints utilized in behavioral P2P botnet detection systems. Then, the resilience of mentioned footprints is analyzed using three evaluation scenarios. Our experimental and analytical investigations indicated that the most P2P botnet footprints are not resilient to the presence of legitimate P2P traffic and there is a pressing need to introduce more resilient footprints.     

基于流量时空特征的fast-flux僵尸网络检测方法

僵尸网络已成为网络空间安全的主要威胁之一,虽然目前可通过逆向工程等技术来对其进行检测,但是使用了诸如fast-flux等隐蔽技术的僵尸网络可以绕过现有的安全检测并继续存活。现有的fast-flux僵尸网络检测方法主要分为主动和被动两种,前者会造成较大的网络负载,后者存在特征值提取繁琐的问题。因此为了有效检测fast-flux僵尸网络并解决传统检测方法中存在的问题,该文结合卷积神经网络和循环神经网络,提出了基于流量时空特征的fast-flux僵尸网络检测方法。结合CTU-13和ISOT公开数据集的实验结果表明,该文所提检测方法和其他方法相比,准确率提升至98.3%,召回率提升至96.7%,精确度提升至97.5%。

     

基于P2P的僵尸网络及其防御

 僵尸网络作为网络犯罪活动的平台,正朝着P2P等分布式结构发展.研究僵尸网络的发展方向以及构建技术,有助于我们全面地了解僵尸网络活动的特点,从而更好地开展僵尸网络的检测和防范研究.本文分析了攻击者的需求,提出了一种基于层次化P2P网络技术的新型僵尸网络结构,并对这种僵尸网络的可行性和具体的传播、通讯、控制等各个方面进行了深入分析和探讨.在此基础上,我们通过模拟实验对各种防御策略的有效性进行了分析和评估,实验数据表明,在考虑实际可操作性条件下,现有的防御策略难以有效摧毁P2P结构僵尸网络.最后,我们讨论了这种新型僵尸网络可能的防御方法.     

A self‐learning stream classifier for flow‐based botnet detection

Botnets have been recently recognized as one of the most formidable threats on the Internet. Different approaches have been designed to detect these types of attacks. However, as botnets evolve their behavior to mislead the signature‐based detection systems, learning‐based methods may be deployed to provide a generalization capacity in identifying unknown botnets. Developing an adaptable botnet detection system, which incrementally evolves with the incoming flow stream, remains as a challenge. In this paper, a self‐learning botnet detection system is proposed, which uses an adaptable classification model. The system uses an ensemble classifier and, in order to enhance its generalization capacity, updates its model continuously on receiving new unlabeled traffic flows. The system is evaluated with a comprehensive data set, which contains a wide variety of botnets. The experiments demonstrate that the proposed system can successfully adapt in a dynamic environment where new botnet types are observed during the system operation. We also compare the system performance with other methods.     

基于深度学习的僵尸网络检测技术研究

入侵检测系统通过分析网络流量来学习正常和异常行为,并能够检测到未知的攻击。一个入侵检测系统的性能高度依赖于特征的设计,而针对不同入侵的特征设计则是一个很复杂的问题。因此,提出了一种基于深度学习检测僵尸网络的系统。该系统利用卷积神经网络(Convolutional Neural Network,CNN)和长短期记忆网络(Long Short-Term Memory,LSTM)分别学习网络流量的空间特征和时序特征,而特征学习的整个过程由深度神经网络自动完成,不依赖于人工设计特征。实验结果表明,该系统在僵尸网络检测方面具有良好的表现。     

Fine‐grained traffic classification based on functional separation

Current efforts to classify Internet traffic highlight accuracy. Previous studies have focused on the detection of major applications such as P2P and streaming applications. However, these applications can generate various types of traffic which are often considered as minor and ignorant traffic portions. As network applications become more complex, the price paid for not concentrating on minor traffic classes is in reduction of accuracy and completeness. In this context, we propose a fine‐grained traffic classification scheme and its detailed method, called functional separation. Our proposal can detect, according to functionalities, different types of traffic generated by a single application and should increase completeness by reducing the amount of undetected traffic. We verify our method with real‐world traffic. Our performance comparison against existing DPI‐based classification frameworks shows that the fine‐grained classification scheme achieves consistently higher accuracyand completeness. Copyright © 2013 John Wiley & Sons, Ltd.     

BotCatcher:botnet detection system based on deep learning

Machine learning technology has wide application in botnet detection.However,with the changes of the forms and command and control mechanisms of botnets,selecting features manually becomes increasingly difficult.To solve this problem,a botnet detection system called BotCatcher based on deep learning was proposed.It automatically extracted features from time and space dimension,and established classifier through multiple neural network constructions.BotCatcher does not depend on any prior knowledge which about the protocol and the topology,and works without manually selecting features.The experimental results show that the proposed model has good performance in botnet detection and has ability to accurately identify botnet traffic .     

基于MapReduce的僵尸网络在线检测算法

目前僵尸网络主要是通过网络流量分析的方法来进行检测,这往往依赖于僵尸主机的恶意行为,或者需要外部系统提供信息。另外传统的流量分析方法计算量很大,难以满足实时要求。为此该文提出一种基于MapReduce的僵尸网络在线检测算法,该算法通过分析网络流量并提取其内在的关联关系检测僵尸网络,并在云计算平台上进行数据分析,使数据获取和数据分析工作同步进行,实现在线检测。实验结果表明该算法的检测率可达到90%以上,误报率在5%以下,并且数据量较大时加速比接近线性,验证了云计算技术在僵尸网络检测方面的可行性。     

基于LLMNR协议与证据理论的本地网络CC信息分享机制

僵尸主机(Bot)安全隐蔽地获取控制命令信息是保证僵尸网络能够正常工作的前提。该文针对本地网络同类型Bot隐蔽地获取控制命令信息问题,提出一种基于LLMNR协议与证据理论的命令控制信息分享机制,首先定义了开机时间比和CPU利用率两个评价Bot性能的指标。其次本地网络中多个同类Bot间利用LLMNR Query包通告各自两个指标值,并利用D-S证据理论选举出僵尸主机临时代表BTL(Bot Temporary Leader)。接着仅允许BTL与命令控制服务器进行通信并获取命令控制信息。最后,BTL通过LLMNR Query包将命令控制信息分发给其它Bot。实验结果表明,该机制能使多个同类Bot完成命令控制信息的共享,选举算法能根据Bot评价指标实时有效选举出BTL,在网络流量较大时仍呈现较强的鲁棒性,且选举过程产生流量也具有较好隐蔽性。     

P2P流量的精细化识别方法研究

目前,已有多种方法可高效准确地完成对P2P流量的粗识别,但对P2P流量的精细化识别研究较少。该文首次将近邻传播(Affinity Propagation, AP)算法引入该领域,在Hi-WAP算法的基础上融合半监督聚类思想提出了一种基于分层加权半监督近邻传播(Hierarchical Weighted Semi-supervised AP, Hi-WSAP)算法的P2P流量精细化识别方法。该方法仅利用10个可快速计算获取的网络流特征对P2P流量按应用进行半监督聚类。两组数据集下的实验结果表明,该方法识别准确率高,时间复杂度低,为P2P流量的实时精细化识别提供了一种实现思路。     

基于抽样流长与完全抽样阈值的异常流自适应抽样算法

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低,对异常流量筛选能力较差的缺陷,该文提出一种基于业务流已抽样长度与完全抽样阈值S的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流,同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明,AFPT算法的估计误差与理论上界相符,具有较强的异常流量筛选能力,能够有效提高异常检测算法的准确率。     

Extending P2PMesh: topology‐aware schemes for efficient peer‐to‐peer data sharing in wireless mesh networks

Wireless mesh networks (WMNs) have emerged as a promising technology that provides low‐cost broadband access to the Internet for fixed and mobile wireless end users. An orthogonal evolution in computer networking has been the rise of peer‐to‐peer (P2P) applications such as P2P data sharing. It is of interest to enable effective P2P data sharing in this type of networks. Conventional P2P data sharing systems are not cognizant of the underlying network topology and therefore suffer from inefficiency. We argue for dual‐layer mesh network architecture with support from wireless mesh routers for P2P applications. The main contribution of this paper is P2PMesh: a topology‐aware system that provides combined architecture and efficient schemes for enabling efficient P2P data sharing in WMNs. The P2PMesh architecture utilizes three schemes: (i) an efficient content lookup that mitigates traffic load imbalance at mesh routers; (ii) an efficient establishment of download paths; and (iii) a data transfer protocol for multi‐hop wireless networks with limited capacity. We note here that the path establishment and data transfer schemes are specific to P2P traffic and that other traffic would use routes determined by the default routing protocol in the WMN. Simulation results suggest that P2PMesh has the potential to improve the performance of P2P applications in a wireless multi‐hop setting; specifically, we focused on data sharing, but other P2P applications can also be supported by this approach. Copyright © 2011 John Wiley & Sons, Ltd.     

优化EPON对本地P2P业务承载能力的研究

P2P流量已成为网络中的主要流量,但现有EPON系统不能很好的承载本地P2P业务.文中从MPCP协议的角度对逻辑链路标签及其过滤规则进行扩展,使本地P2P数据包不需经OLT端二层交换即可实现下行转发,从而大大改善了P2P业务的QoS.并以此方案为基础,提出改进EPON的DBA算法,设置专门的P2P时隙,实现P2P业务的全光域转发.两种方案的建模仿真结果表明,两者均能明显改善EPON对本地P2P业务的承载能力.     

基于Command and Control通信信道流量属性聚类的僵尸网络检测方法

僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel, CC)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和CC协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对CC信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。     

基于行为相似性的P2P僵尸网络检测模型

P2P僵尸网络对Internet构成巨大的安全威胁。在基于主机的P2P流量检测和恶意行为检测的基础上,提出一个P2P僵尸网络的检测模型。构建一个基于CHORD协议由监视节点组成的结构化P2P网络,将同时具有P2P流量和恶意行为的主机信息上报监视节点。通过对P2P僵尸主机行为进行融合分析,具有相似性恶意行为的主机被认为处于一个P2P僵尸网络中。     

高速网络环境下的P2P流媒体业务分析和识别方法

The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,a...     

Analysis on the time-domain characteristics of botnets control traffic

Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol(IP) addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol(DHCP),so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can’t be always online.The whole process is carried out under the command and control(C&C) channel.Our goal is to characterize the network traffic under the C&C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider(ISP) Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection(DPI) Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C&C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection(DFI) technology.     

RAPS: a precision‐adaptive protocol towards improved data fidelity in wireless sensor networks

Achieving high data quality and efficient network resource utilization is two major design objectives of wireless sensor networks (WSNs). However, these two objectives are often conflictive. By allowing sensors to report sampled data at high rates, fine‐grained data quality can be obtained. However, the limited resources of a WSN make it difficult to support very high traffic rate. Therefore, the capability of adaptively adjusting sensor nodes' traffic‐generating rates on the basis of the availability of network resources and application requirements is critical. This issue has attracted much attention recently, and some work has been carried out. To achieve high data quality and improved utilization of network resources, in this paper, we propose rate‐based adaptive precision setting (RAPS) protocol, which works in a way that each sensor can adaptively adjust its traffic‐generating rate on the basis of the current network resources availability and application requirements. RAPS introduces the following two key factors into its design: application's precision requirement and packet arrival rate. Analytical and simulation results show that RAPS can achieve improved data quality while reducing packet delivery latency. Copyright © 2012 John Wiley & Sons, Ltd.     

僵尸网络活动调查分析

僵尸网络已经成为网络攻击者首选的攻击平台，用以发起分布式拒绝服务攻击、窃取敏感信息和发送垃圾邮件等，对公共互联网的正常运行和互联网用户的利益造成了严重的威胁。较大规模地发现和监测实际僵尸网络的活动行为并对其规律进行深入调查分析，是更为全面地监测僵尸网络和对其实施反制的必要前提。通过对所监测的1961个实际僵尸网络的活动情况进行了深入调查和分析，从中给出了僵尸网络数量增长情况、控制服务器分布、僵尸网络规模、被控主机分布以及僵尸网络各种攻击行为的分析结果。