臺灣博碩士論文加值系統

隨著電腦硬體技術和網路速度的提升，惡意使用者攻擊的對象已經從伺服器轉為個人電腦。駭客藉由散布電腦病毒、蠕蟲和木馬程式，在網路上大量控制受害者的電腦主機，竊取電腦上的私人機密資料，並透過命令控制這些主機來發送大量的攻擊。受害的電腦主機通常被稱為殭屍主機。而這些被控制的電腦所形成的網路即稱為殭屍網路。
在本論文中，我們利用網路連線失敗來區分出正常流量、P2P流量和感染殭屍網路的流量。依據我們的觀察，受感染的電腦由於需要連線到駭客下指令的控制伺服器，在伺服器IP位置分散且動態改變下，感染的主機必然會產生失敗的連線。藉由觀察正常流量、P2P和殭屍主機內網向外網失敗的連線，從中取出相關特徵屬性值，再將這些特徵值透過機器學習創造出偵測模型，利用偵測模型來區分不同類型的流量。我們所提出的偵測方法，從模擬的實驗結果中顯示可得到高的偵測準確率和召回率。對於真實流量上做偵測，被偵測出的電腦主機，有96%以上證實的確有遭受感染。我們所提出的偵測方法，對於網路的管理者而言，能有效地判斷出遭受感染的主機，在幫助殭屍網路偵測上，亦具有遏止更多主機免於受害的功效。

With the advances of computer hardware and Internet techniques, the target of malicious users has been moved from servers to personal computers. In addition to steal sensitive information from the compromised computers, malicious users also command these computers to launch large scale Internet attacks. Groups of compromised computers form a network called botnet. Each computer in the network is a bot and the malicious user, i.e., the bot master, controls it remotely.
In this paper, we proposed a failure based botnet detection technique to distinguish computers that generate normal, peer-to-peer, and bot traffic. Based on our observations, it is inevitable for bots to generate irregular failures due to their dynamic and distributed design. By measuring several different types of failures generated from outbound TCP, UDP, and DNS requests, we create failure models for normal, peer-to-peer, and bot hosts using machine learning techniques. Then, we use the models to identify bots in both simulated traffic and real traffic. Experiments show that the proposed solution has good precision and recall rates with simulated traffic. When it is applied to a real network, more than 96% of identified bot hosts are verified to be real bots. In addition to its good performance, the ability of the detector can be easily enhanced by training the models with more bot samples. We believe that the proposed solution is a practical tool for network administrators to identify bots in a network and then mitigate damages brought by bots.

摘要 I
Abstract II
誌謝 III
目錄 V
圖目錄 VII
表目錄 IX
第一章 、緒論 1
1.1、研究背景 1
1.2、研究動機 1
1.3、研究目的 3
1.4、論文架構 4
第二章 、相關研究 5
2.1、Botnet介紹 5
2.1.1、殭屍網路架構與分類 6
2.1.2、殭屍網路通訊方式 9
2.1.3、殭屍網路偵測方式 9
第三章 、研究方法 13
3.1、問題分析與對策 13
3.2、連線種類介紹 13
3.2.1、TCP連線失敗 15
3.2.2、UDP連線失敗 16
3.2.3、DNS連線失敗 17
3.3、嗅探器 18
3.4、分類屬性特徵 19
3.5、分析統計預測 21
3.6、偵測方式 22
3.7、技術架構與設計方法 22
第四章 、實驗與結果 24
4.1、流量收集環境 24
4.2、模型訓練與實驗數據 27
4.3、實驗數據 28
4.3.1、偵測效能準確性評估 29
4.3.2、分類實驗結果 29
4.4、結果評估 46
第五章 、結論與未來工作 48
參考文獻 49

[1]. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee, “BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation”. In Proceedings of the 16th USENIX Security Symposium on USENIX Security Symposium, CA, USA. 2008.
[2]. G. Gu, J. Zhang, and W. Lee, “BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic”. In Proceedings of the Network and Distributed System Security Symposium. 2008.
[3]. F. Giroire, J. Chandrashekar, N. Taft, E. Schooler, D. Papagiannaki, “Exploiting Temporal Persistence to Detect Covert Botnet Channels”. In Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection, September. 2009.
[4]. S. Gianvecchio, M. Xie, Z. Wu, and H. Wang, “Measurement and Classification of Humans and Bots in Internet Chat”. In Proceedings of the 17th conference on Security symposium, CA, USA. 2008.
[5]. P. Baecher, M. Koetter, M. Dornseif, and F. Freiling, “The nepenthes platform: An efficient approach to collect malware”. In Proceedings of the 9 th International Symposium on Recent Advances in Intrusion Detection. 2006.
[6]. S. Small, J. Mason, F. Monrose, N. Provos, and A. Stubblefield, “To catch a predator: a natural language approach for eliciting malicious payloads”. In Proceedings of the 17th conference on Security symposium, San Jose, CA July. 2008.
[7]. 涂浩, 李之棠, 周麗娟, “基於DNS 通信數據挖掘的Botnet 檢測方法研究”. 發表在廈門大學核心期刊學報. 2007.
[8]. N. Provos and T. Holz, “Virtual honeypots: From botnet tracking to intrusion detection”. Addison-Wesley, July. 2007.
[9]. C. C. Zou and R. Cunningham, “Honeypot-aware advanced botnet construction and maintenance”. In Proceedings of the International Conference on Dependable Systems and Networks, Orlando, FL, June. 2006.
[10]. Ting-Fang Yen and Michael K. Reiter, “Traffic aggregation for malware detection”. In Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Springer-Verlag Berlin, Heidelberg. 2008.
[11]. D. Moore, C. Shannon, D. J. Brown, G. M. Voelker, and S. Savage, “Inferring Internet Denial of Service Activity”. In Proceedings of the ACM Transactions on Computer Systems, NY, USA, May, 2006.
[12]. A. Ramachandran and N. Feamster, “Understanding the Network-level Behavior of Spammers”. In Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communications ACM, NY, USA, October. 2006.
[13]. S. Saroiu, S. Gribble, and H. Levy, “Measurement and Analysis of Spyware in a University Environment”. In Proceedings of the 1st Symposium on Networked Systems Design and Implementation, San Francisco, CA, March. 2004.
[14]. P. Bacher, T. Holz, M. Kotter, and G. Wicherski, “Know your Enemy: Tracking Botnets”. http://www.honeynet.org/papers/bots. 2008.
[15]. J. Zhuge, T. Holz, X. Han, J. Guo, and W. Zou, “Characterizing the irc-based botnet phenomenon”. Peking University & University of Mannheim Technical Report, 2007.
[16]. J. B. Grizzard, V. Sharma, C. Nunnery, B. ByungHoon Kang, and D. Dagon, “Peer-to-peer botnets: overview and case study”. In Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, Cambridge, MA, April. 2007.
[17]. Jae-Seo Lee, HyunCheol Jeong, Jun-Hyung Park, Minsoo Kim, and Bong-Nam Noh, “The Activity Analysis of Malicious HTTP-Based Botnets Using Degree of Periodic Repeatability”. In Proceedings of the International Conference on Security Technology, South Korea, December. 2008.
[18]. H. Binsalleeh, T. Ormerod, A. Boukhtouta, P. Sinha, A. Youssef, M. Debbabi, and L. Wang, “On the Analysis of the Zeus Botnet Crimeware Toolkit”. In Proceedings of the Eighth Annual Conference on Privacy, Security and Trust, Ottawa, ON, Canada, Aug. 2010.
[19]. J. Ross Quinlan, “C4.5: Programs for Machine Learning”. Morgan Kaufmann Publishers Inc. San Francisco, CA, USA. 1993.
[20]. Z. Zhu, V. Yegneswaran, and Y. Chen, “Using Failure Information Analysis to Detect Enterprise Zombies”. In Proceedings of the IEEE Security & Privacy. 2009.
[21]. P. Prakash, M. Kumar, R. Rao Kompella, M. Gupta, “Phishnet: predictive blacklisting to detect phishing attacks”. In Proceedings of the 29th conference on Information communications IEEE Press Piscataway, NJ, USA. 2010.
[22]. H. Choi, H. Lee, H. Lee, H. Kim, “Botnet Detection by Monitoring Group Activities in DNS Traffic”. In Proceedings of the 7th IEEE International Conference on Computer and Information Technology, DC, USA, Oct. 2007.
[23]. Peter Wurzinger, Leyla Bilge, Thorsten Holz, Jan Goebel, Christopher Kruegel, and Engin Kirda: “Automatically Generating Models for Botnet Detection”. In Proceedings of the 14th European Symposium on Research in Computer Security, Raleigh, NC. 2009.
[24]. Panda Cyber-Crime Files, http://cybercrime.pandasecurity.com/mariposa/index.php?lang=tw
[25]. 2010 kaspersky Threat Report, http://www.kaspersky.com.hk/support/News2010/100609.htm
[26]. 2010 Symantec Network Security Threat Report, https://scm.symantec.com/istr2010/tw/
[27]. Fast Flux, http://www.i-security.tw/topic/topic_sg.asp?id=159
[28]. tcpdump/libpcap, http://www.tcpdump.org/
[29]. Weka, http://www.cs.waikato.ac.nz/ml/weka/
[30]. MyDoom, http://www.stat.gov.tw/ct.asp?xItem=5031&ctNode=418
[31]. Offensive Computing, http://www.offensivecomputing.net/
[32]. WA Network Security Service Center, http://cqwafw.com/scan/scanlist.asp
[33]. Whois365.com, http://www.whois365.com/tw
[34]. Snort, http://www.snort.org/