新型混合P2P僵尸网络：更难追踪与防御

5星 · 超过95%的资源需积分: 10 107 浏览量更新于2024-12-02 收藏 159KB PDF 举报

"这篇论文探讨了一种先进的混合型P2P僵尸网络的设计，旨在提高攻击者控制下的网络的鲁棒性和复杂性。该僵尸网络比现有的僵尸网络更难被关闭、监控和劫持，通过提供强大的网络连接性、个性化的加密、控制流量分散以及每个‘bot’对僵尸网络暴露的限制，增强了对‘botmaster’的监控和恢复能力。同时，论文还提出了针对这种先进僵尸网络的防御策略建议。" 僵尸网络（Botnet）是一种由攻击者（Botmaster）控制的被妥协计算机网络，近期已经成为互联网攻击的主要源头。为了有效应对未来的威胁，研究如何检测和防御过去出现的僵尸网络是不够的，更重要的是需要预研可能由攻击者在未来开发的高级僵尸网络技术。在本文中，作者提出了一个先进的混合P2P（Peer-to-Peer）僵尸网络设计。与传统僵尸网络相比，这个新型设计具有以下特点： 1. **难以关闭和监控**：通过采用P2P架构，网络中的每个节点既是客户端也是服务器，这使得网络更加分散，增加了关闭整个网络的难度。攻击者可以更隐蔽地控制网络，使其不易被传统的集中式追踪方法发现。 2. **个体化加密**：每个‘bot’都采用个性化的加密机制，增加了安全性和隐私性，使得外部监测和解密控制流量变得更加困难。 3. **控制流量分散**：通过将控制流量分散到网络的不同部分，进一步降低了被识别和阻断的可能性，提高了网络的生存能力。 4. **有限的暴露度**：每个‘bot’对整个僵尸网络的贡献有限，降低了单个节点被追踪的风险，从而降低了整个网络被破坏的可能性。 5. **易于监控和恢复**：尽管网络结构复杂，但‘botmaster’可以通过设计的机制轻松监控每个节点的状态，并在必要时快速恢复受损的部分。论文还讨论了可能的防御策略，包括但不限于： - **增强检测机制**：通过改进签名和行为基线分析，以识别出新型P2P僵尸网络的异常行为。 - **网络隔离和阻断**：利用网络流量分析来定位和隔离可疑的P2P通信，阻止恶意活动。 - **诱饵系统**：部署诱饵系统来误导‘botmaster’，使他们误以为已成功感染了假的‘bots’。 - **修复和防护**：快速更新和修补漏洞，提高用户的安全意识，防止计算机被感染并加入僵尸网络。这篇论文揭示了未来可能的高级僵尸网络威胁，并提供了关于如何对抗这些威胁的见解，对于网络安全研究和防御策略的制定具有重要参考价值。

An Advanced Hybrid Peer-to-Peer Botnet

Ping Wang Sherri Sparks Cliff C. Zou

School of Electrical Engineering and Computer Science

University of Central Florida, Orlando, FL

{pwang, ssparks, czou}@cs.ucf.edu

Abstract— A “botnet” consists of a network of compromised

computers controlled by an attacker (“botmaster”). Recently

botnets have become the root cause of many Internet attacks.

To be well prepared for future attacks, it is not enough to study

how to detect and defend against the botnets that have appeared

in the past. More importantly, we should study advanced botnet

designs that could be developed by botmasters in the near future.

In this paper, we present the design of an advanced hybrid peer-

to-peer botnet. Compared with current botnets, the proposed

botnet is harder to be shut down, monitored, and hijacked. It

provides robust network connectivity, individualized encryption

and control trafﬁc dispersion, limited botnet exposure by each

bot, and easy monitoring and recovery by its botmaster. Possible

defenses against this advanced botnet are suggested.

I. INTRODUCTION

In the last several years, Internet malware attacks have

evolved into better organized and more proﬁt-centered endeav-

ors. Email spam, extortion through denial-of-service attacks

[1], and click fraud [2] represent a few examples of this

emerging trend. “Botnets” are a root cause of these problems

[3], [4], [5]. A “botnet” consists of a network of compromised

computers (“bots”) connected to the Internet that is controlled

by a remote attacker (“botmaster”) [6], [5]. Since a botmaster

could scatter attack tasks over hundreds or even tens of

thousands of computers distributed across the Internet, the

enormous cumulative bandwidth and large number of attack

sources make botnet-based attacks extremely dangerous and

hard to defend against.

Compared to other Internet malware, the unique feature of a

botnet lies in its control communication network. Most botnets

that have appeared until now have had a common centralized

architecture. That is, bots in the botnet connect directly to

some special hosts (called “command-and-control” servers, or

“C&C” servers). These C&C servers receive commands from

their botmaster and forward them to the other bots in the

network. From now on we will call a botnet with such a control

communication architecture a “C&C botnet”. Fig. 1 shows the

basic control communication architecture for a typical C&C

botnet (in reality, a C&C botnet usually has more than two

C&C servers). Arrows represent the directions of network

connections.

As botnet-based attacks become popular and dangerous,

security researchers have studied how to detect, monitor, and

defend against them [3], [6], [1], [4], [7], [5]. Most of the

current research has focused upon the C&C botnets that have

appeared in the past, especially Internet Relay Chat (IRC)

based botnets. It is necessary to conduct such research in

order to deal with the threat we are facing today. However,

it is equally important to conduct research on advanced botnet

designs that could be developed by attackers in the near future.

Otherwise, we will remain susceptible to the next generation

of internet malware attacks.

From a botmaster’s perspective, the C&C servers are the

fundamental weak points in current botnet architectures. First,

a botmaster will lose control of his or her botnet once the

limited number of C&C servers are shut down by defenders.

Second, defenders could easily obtain the identities (e.g., IP

addresses) of all C&C servers based on their service trafﬁc to

a large number of bots [7], or simply from one single captured

bot (which contains the list of C&C servers). Third, an entire

botnet may be exposed once a C&C server in the botnet is

hijacked or captured by defenders [4]. As network security

practitioners put more resources and effort into defending

against botnet attacks, hackers will develop and deploy the

next generation of botnets with a different control architecture.

A. Current P2P Botnets and Their Weaknesses

Considering the above weaknesses inherent to the cen-

tralized architecture of current C&C botnets, it is a natural

strategy for botmasters to design a peer-to-peer (P2P) control

mechanism into their botnets. In the last several years, botnets

such as Slapper [8], Sinit [9], Phatbot [10] and Nugache [11]

have implemented different kinds of P2P control architectures.

They have shown several advanced designs. For example,

in order to remove the bootstrap process which is easily

exploited by defenders to shut down a botnet, the Slapper

worm builds a list of known bots for each infected computer

during propagation [8]. Sinit likewise lacks a bootstrap process

and uses public key cryptography for update authentication

[9]. Nugache attempts to thwart detection by implementing an

encrypted/obsfucated control channel [11].

Nevertheless, simply migrating available P2P protocols will

not generate a sound botnet, and the P2P designs in those

botnets appeared before are not mature and have many weak-

nesses. A Sinit bot uses random probing to ﬁnd other Sinit

bots to communicate with. This results in poor connectivity for

the constructed botnet and easy detection due to the extensive

probing trafﬁc [9]. Phatbot utilizes Gnutella cache servers

for its bootstrap process. This also makes the botnet easy

to shut down. In addition, its underlying WASTE peer-to-

peer protocol is not scalable across a large network [10].

Nugache’s weakness lies in its reliance on a seed list of 22

IP addresses during its bootstrap process [11]. Slapper fails to

下载后可阅读完整内容，剩余8页未读，立即下载

borelist

粉丝: 1
资源: 18

新型混合P2P僵尸网络：更难追踪与防御

Modeling Peer-to-Peer Botnets

PPCoin: Peer-to-Peer Crypto-Currency with Proof-of-Stake

Peer-to-Peer-File-sharing-systems-Advanced-Operating-System:源代码

An Introduction to Peer-to-Peer networks.

Deep Analysis of Intending Peer-to-Peer Botnet

peer-to-peer-backup

Peer-to-peer-Network

Peer-to-Peer-Socket-C

peer-to-peer-project-3

Universal Peer-to-Peer-开源

最新资源