基于域名系统流量的Fast-Flux僵尸网络检测方法

doi:10.3969/j.issn.1000-3428.2017.09.033

计算机工程

基于域名系统流量的Fast-Flux僵尸网络检测方法

左晓军¹,董立勉¹,曲武²

(1.国网河北省电力公司电力科学研究院,石家庄 050021;2.北京启明星辰信息安全技术有限公司核心研究院,北京 100193)

收稿日期:2016-05-19 出版日期:2017-09-15 发布日期:2017-09-15
作者简介:左晓军(1973—),男,高级工程师、硕士,主研方向为信息安全、网络管理、软件工程;董立勉,高级工程师;曲武,博士后、CCF会员。

Fast-Flux Botnet Detection Method Based on Domain Name System Traffic

ZUO Xiaojun ¹,DONG Limian¹,QU Wu²

(1.Electric Power Research Institute,State Grid Hebei Electric Power Company,Shijiazhuang 050021,China; 2.Core Research Institute,Beijing Venustech Cybervision Co.,Ltd.,Beijing 100193,China)

Received:2016-05-19 Online:2017-09-15 Published:2017-09-15

摘要/Abstract

摘要： 在僵尸网络中,为保持服务器的可用性和隐蔽性,与域名关联的Flux-Agent的IP地址需要不停地变动,而黑名单策略对于阻止Fast-Flux僵尸网络攻击已经失效。为解决该问题,基于域名系统流量的分析和识别技术,提出一种新的Fast-Flux僵尸网络检测方法,用于检测互联网中使用Fast-Flux技术的僵尸网络,且对域名的分析不局限于来自垃圾邮件、点击欺诈或黑名单列表的可疑域名。实验结果表明,该方法能够以较高的准确率检测Fast-Flux僵尸网络,并且有利于完善黑名单列表。

关键词: 僵尸网络, Fast-Flux域名, 域名系统流量, 层次聚类, 机器学习

Abstract: In a botnet,to maintain availability and invisibility of servers,the IP address of Flux-Agent associated with the domain name is changing constantly,and the blacklist policy is no longer effective in preventing Fast-Flux botnet attacks.In order to solve this problem,based on the analysis and recognition technologies of domain name system traffic,a new Fast-Flux botnet detection method is proposed.The method can detect the botnet using Fast-Flux technology in the Internet,which is not confined to the analysis of suspicious domain names from spame-mails,click fraud,or blacklists.Experimental results show that,this method can detect Fast-Flux botnets with higher accuracy,and help to give a more perfect blacklist.

Key words: botnet, Fast-Flux domain name, Domain Name System(DNS)traffic, hierarchical clustering, machine learning

中图分类号:

TP393.08

左晓军,董立勉,曲武. 基于域名系统流量的Fast-Flux僵尸网络检测方法[J]. 计算机工程, doi: 10.3969/j.issn.1000-3428.2017.09.033.

ZUO Xiaojun,DONG Limian,QU Wu. Fast-Flux Botnet Detection Method Based on Domain Name System Traffic[J]. Computer Engineering, doi: 10.3969/j.issn.1000-3428.2017.09.033.

http://www.ecice06.com/CN/Y2017/V43/I9/185

参考文献

参考文献［1］诸葛建伟,韩心慧,周勇林,等.僵尸网络研究［J］.软件学报,2008,19(3):702-715. ［2］ZHOU Shijie.A Survey on Fast-Flux Attacks［J］.Information Security Journal:A Global Perspective,2015,24(4-6):79-97. ［3］GOEBEL J,HOLZ T.Rishi:Identify Bot Contaminated Hosts by Irc Nickname Evaluation［C］//Proceedings of the 1st Workshop on Hot Topics in Understanding Botnets.New York,USA:ACM Press,2007:8. ［4］BINKLEY J R,SINGH S.An Algorithm for Anomaly-based Botnet Detection［C］//Proceedings of the 2nd Con-ference on Steps to Reducing Unwanted Traffic on the Internet.New York,USA:ACM Press,2006:43-48. ［5］GU Guofei,PORRAS P A,YEGNESWARAN V,et al.Bot Hunter:Detecting Malware Infection Through IDS-driven Dialog Correlation［C］//Proceedings of the 16th USENIX Security Symposium on USENIX Security Symposium.New York,USA:ACM Press,2007:1-16. ［6］KARASARIDIS A,REXROAD B,HOEFLIN D.Wide-scale Botnet Detection and Characterization［C］//Proceedings of the 1st Conference on Hot Topics in Understanding Botnets.New York,USA:ACM Press,2007:1-7. ［7］GU G,ZHANG J,LEE W.Bot Sniffer:Detecting Botnet Command and Control Channels in Network Traffic［C］//Proceedings of the 15th Annual Network and Distributed System Security Symposium.New York,USA:ACM Press,2008:2-19. ［8］COOKE E,JAHANIAN F,MCPHERSON D.The Zombie Roundup:Understanding,Detecting,and Disrupting Botnets［C］//Proceedings of the Steps to Reducing Unwanted Traffic on the Internet Workshop.New York,USA:ACM Press,2005:1-6. ［9］ABU R M,ZARFOSS J,MONROSE F,et al.A Multifaceted Approach to Understanding the Botnet Phenomenon［C］//Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement.New York,USA:ACM Press,2006:41-52. ［10］FABIAN M,TERZIS M A.My Botnet is Bigger than Yours (Maybe,Better than Yours):Why Size Estimates Remain Challenging［C］//Proceedings of the 1st USENIX Workshop on Hot Topics in Understanding Botnets.New York,USA:ACM Press,2007:1-5. ［11］DAGON D,ZOU C C,LEE W.Modeling Botnet Propaga-tion Using Time Zones［C］//Proceedings of Network & Distributed System Security Symposium.New York,USA:ACM Press,2006:2-13. ［12］GRIZZARD J B,SHARMA V,NUNNERY C,et al.Peer-to-Peer Botnets:Overview and Case Study［C］//Proceedings of the 1st Conference on Hot Topics in Understanding Botnets.New York,USA:ACM Press,2007:1. ［13］WANG Ping,SPARKS S,ZOU C C.An Advanced Hybrid Peer-to-Peer Botnet［J］.IEEE Transactions on Dependable and Secure Computing,2010,7(2):113-127. ［14］HOLZ T,GORECKI C,FREILING F,et al.Detection and Mitigation of Fast-flux Service Networks［EB/OL］.(2009-03-03).http://www.isoc.org/isoc/conferences/ndss/08/papers/16_measuring_and_detecting.pdf ［15］康乐.基于 DNS 数据流的僵尸网络检测技术研究［D］.哈尔滨:哈尔滨工业大学,2011. ［16］KONTE M,FEAMSTER N,JUNG J.Fast Flux Service Networks:Dynamics and Roles in Online Scam Hosting Infrastructure［M］.［S.l.］:Georgia Institute of Tech-nology,2008. ［17］PASSERINI E,PALEARI R,MARTIGNONI L,et al.FluxOR:Detecting and Monitoring Fast-flux Service Networks［M］//Flegel U,Markatos E,Robertson W.Detection of Intrusions and Malware,and Vulnerability Assessment.Berlin,Germany:Springer,2008. ［18］HU Xin,KNYSZ M,SHIN K G.Measurement and Analysis of Global IP-usage Patterns of Fast-flux Botnets［C］//Proceedings of INFOCOM’11.Washington D.C.,USA:IEEE Press,2011:2633-2641. 编辑顾逸斐

[1]	陈治旭, 靳雁霞, 芦烨, 杨晶, 刘亚变, 史志儒. 基于子图卷积神经网络的多精度服装建模方法[J]. 计算机工程, 2023, 49(4): 174-181.
[2]	刘金硕, 詹岱依, 邓娟, 王丽娜. 基于深度神经网络和联邦学习的网络入侵检测[J]. 计算机工程, 2023, 49(1): 15-21,30.
[3]	葛昕, 邹福泰, 郭万达, 谭越, 李林森. 社交僵尸网络发展综述[J]. 计算机工程, 2022, 48(8): 12-24.
[4]	俞莎莎, 牛保宁. 基于交易不可信度的比特币非法交易检测[J]. 计算机工程, 2022, 48(8): 166-172.
[5]	金海波, 赵欣越. 共形预测框架下的高可靠入侵检测算法[J]. 计算机工程, 2022, 48(7): 130-140.
[6]	钱龙, 赵静, 韩京宇, 毛毅. 基于标签相关性的K近邻多标签学习[J]. 计算机工程, 2022, 48(6): 73-78,88.
[7]	李莉, 任振康, 石可欣. 代价敏感的Boosting软件缺陷预测方法[J]. 计算机工程, 2022, 48(3): 175-180.
[8]	田盼盼, 陈璟. 基于层次聚类的生物网络全局比对算法[J]. 计算机工程, 2022, 48(2): 65-71,78.
[9]	刘鹏, 叶润, 闫斌, 谢茜, 刘睿. 一种深度回声状态网络的输入尺度自适应算法[J]. 计算机工程, 2022, 48(2): 92-98,105.
[10]	雷恒林, 古兰拜尔·吐尔洪, 买日旦·吾守尔, 曾琪. 基于Hellinger距离与词向量的终身机器学习主题模型[J]. 计算机工程, 2022, 48(11): 89-95.
[11]	陈良臣, 傅德印. 面向小样本数据的机器学习方法研究综述[J]. 计算机工程, 2022, 48(11): 1-13.
[12]	赵季红, 张文娟, 乔琳琳, 张梦雪. 服务功能链中基于机器学习的QoE评估与预测[J]. 计算机工程, 2022, 48(1): 163-169.
[13]	高平, 广晖, 陈熹, 李光松. 基于侧信道特征的安全代理流量分类方法[J]. 计算机工程, 2021, 47(8): 140-148,156.
[14]	苗立志, 白瑞思蒙, 刘成良, 翟月昊. 面向非平衡数据的癌症患者生存预测分析[J]. 计算机工程, 2021, 47(12): 316-320.
[15]	张彭明, 张晓梅, 胡建鹏. 基于动态信任值的智能手机隐式认证方案[J]. 计算机工程, 2021, 47(10): 132-139,146.

选择文件类型/文献管理软件名称

选择包含的内容

基于域名系统流量的Fast-Flux僵尸网络检测方法

Fast-Flux Botnet Detection Method Based on Domain Name System Traffic

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于域名系统流量的Fast-Flux僵尸网络检测方法

Fast-Flux Botnet Detection Method Based on Domain Name System Traffic

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价