社交僵尸网络发展综述

doi:10.19678/j.issn.1000-3428.0061381

摘要/Abstract

摘要： 随着社交平台的发展，社交媒体网络逐渐成为攻击者进行僵尸网络渗透的理想平台。社交僵尸网络利用社交平台自动化程度高、灵活性强与普及度高等特性构建隐蔽信道进行通信，以达到窃取社交平台用户信息、散布不良信息污染网络环境、引导控制舆论等目的。传统的僵尸网络检测机制无法有效地检测社交僵尸网络，为社交媒体的安全性带来极大的挑战。从社交僵尸网络的概念入手，阐述社交僵尸网络在不同社交平台上的发展脉络和发展趋势，研究不同社交媒体上的社交僵尸网络攻击原理和群体特征以及隐蔽型社交僵尸网络的隐蔽手段。在此基础上，将社交僵尸网络的检测方法分为服务器端检测方法和客户端检测方法，并对近年来出现的基于隐写技术和基于机器学习的检测方法进行分析，同时给出社交僵尸网络的反制技术和接管方法的研究现状及发展思路，并对该领域的未来研究方向进行展望。

关键词: 网络安全, 社交僵尸网络, 命令与控制信道, 隐写技术, 机器学习

Abstract: With the development of social platforms, social media networks have gradually become an ideal platforms for attackers to infiltrate Botnets.Social botnets utilize the high flexibility, degree of automation, and popularity of social platforms to create covert channels for communication to steal social media platform user information, disseminate bad information to pollute the network environment, and control public opinion.Traditional botnet detection mechanisms cannot effectively detect social botnets, causing significant challenges to social media security.From the concept of social botnets, the developmental context and trends of social botnets on different social platforms are explained.In addition, the attack principles and group characteristics of social botnets on different social media and the concealment methods of covert social botnets are analyzed. On this basis, the detection methods of social botnets are divided into server-side and client-side, and the detection methods based on steganography and machine learning in recent years are analyzed.Furthermore, the research status and development ideas of the countermeasure technology and takeover method of social botnets are discussed, and future research directions in this field are suggested.

Key words: cyber security, social Botnets, Command and Control(C&C) channels, steganography, machine learning

中图分类号:

TP309

葛昕, 邹福泰, 郭万达, 谭越, 李林森. 社交僵尸网络发展综述[J]. 计算机工程, 2022, 48(8): 12-24.

GE Xin, ZOU Futai, GUO Wanda, TAN Yue, LI Linsen. Review on Development of Social Botnets[J]. Computer Engineering, 2022, 48(8): 12-24.

https://www.ecice06.com/CN/Y2022/V48/I8/12

图/表 9

20220825090628

20220825090632

20220825090635

20220825090639

20220825090643

20220825090646

20220825090650

20220825090654

20220825090658

参考文献

[1] 伍静, 詹千熠, 刘渊.一种结合文本情感分析的微博僵尸粉识别模型[J].计算机工程, 2020, 46(6):288-295. WU J, ZHAN Q Y, LIU Y.A zombie fans recognition model for microblog combining text sentiment analysis[J].Computer Engineering, 2020, 46(6):288-295.(in Chinese)
[2] NAGARAJA S, HOUMANSADR A, PIYAWONGWISAL P, et al.Stegobot:a covert social network botnet[C]//Proceedings of IEEE International Conference on Information Hiding.Washington D.C., USA:IEEE Press, 2011:299-313.
[3] YIN T, ZHANG Y Z, LI S H.DR-SNBot:a social network-based botnet with strong destroy-resistance[C]//Proceedings of the 9th IEEE International Conference on Networking, Architecture, and Storage.Washington D.C., USA:IEEE Press, 2014:191-199.
[4] PANTIC N, HUSAIN M I.Covert botnet command and control using Twitter[C]//Proceedings of the 31st Annual Computer Security Applications Conference.New York, USA:ACM Press, 2015:171-180.
[5] 诸葛建伟, 韩心慧, 叶志远, 等.僵尸网络的发现与跟踪[C]//2005年全国网络与信息安全技术研讨会论文集.北京:[出版者不详], 2005:1-7. ZHUGE J W, HAN X H, YE Z Y, et al.Discovery and tracking of botnets[C]//Proceedings of 2005 National Symposium on Network and Information Security Technology.Beijing:[s.n.], 2005:1-7.(in Chinese)
[6] 张治起.僵尸网络命令控制信道研究[D].北京:北京邮电大学, 2012. ZHANG Z Q.Research on command and control channel of botnet[D].Beijing:Beijing University of Posts and Telecommunications, 2012.(in Chinese)
[7] HOLZ T, GORECKI C, FREILING F, et al.Detection and mitigation of fast-flux service networks[C]//Proceedings of the 15th Annual Network and Distributed System Security Symposium.Washington D.C., USA:IEEE Press, 2008:2268-2277.
[8] STONE-GROSS B, COVA M, CAVALLARO L, et al.Your botnet is my botnet:analysis of a botnet takeover[C]//Proceedings of the 16th ACM Conference on Computer and Communications Security.New York, USA:ACM Press, 2009:635-647.
[9] CUI X, FANG B X, YIN L H, et al.Andbot:towards advanced mobile botnets[C]//Proceedings of the 4th USENIX Conference on Large-scale Exploits and Emergent Threats.[S.1.]:USENIX Association, 2011:1-11.
[10] MENDES L D P, ALOI J, PIMENTA T C.Analysis of IoT botnet architectures and recent defense proposals[C]//Proceedings of the 31st IEEE International Conference on Microelectronics.Washington D.C., USA:IEEE Press, 2019:186-189.
[11] KAMBOURAKIS G, KOLIAS C, STAVROU A.The mirai botnet and the IoT zombie armies[C]//Proceedings of IEEE Military Communications Conference.Washington D.C., USA:IEEE Press, 2017:267-272.
[12] BALLANO M.Is there an Internet-of-things vigilante out there[EB/OL].[2021-03-10].https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ef23b297-5cc6-4c4a-b2e7-ff41635965fe&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments.
[13] ALI S T, MCCORRY P, LEE P H J, et al.ZombieCoin:powering next-generation botnets with bitcoin[C]//Proceedings of International Conference on Financial Cryptography and Data Security.Berlin, Germany:Springer, 2015:34-48.
[14] FRANZONI F, ABELLAN I, DAZA V.Leveraging bitcoin testnet for bidirectional botnet command and control systems[C]//Proceedings of International Conference on Financial Cryptography and Data Security.Berlin, Germany:Springer, 2020:3-19.
[15] Socialbot[EB/OL].[2021-03-10].https://en.wikipedia.org/wiki/Social_bot.
[16] 倪平, 张玉清, 闻观行, 等.基于群体特征的社交僵尸网络检测方法[J].中国科学院大学学报, 2014, 31(5):691-700, 713. NI P, ZHANG Y Q, WEN G X, et al.Detection of socialbot networks based on population characteristics[J].Journal of University of Chinese Academy of Sciences, 2014, 31(5):691-700, 713.(in Chinese)
[17] GRIZZARD J B, SHARMA V, NUNNERY C, et al.Peer-to-peer botnets:overview and case study[C]//Proceedings of HotBotsʼ07.New York, USA:ACM Press, 2007:1-8.
[18] RATKIEWICZ J, CONOVER M, MEISS M, et al.Truthy:mapping the spread of Astroturf in microblog streams[C]//Proceedings of the 20th International Conference Companion on World Wide Web.Washington D.C., USA:IEEE Press, 2011:249-252.
[19] DICKERSON J P, KAGAN V, SUBRAHMANIAN V S.Using sentiment to detect bots on Twitter:are humans more opinionated than bots?[C]//Proceedings of 2014 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining.New York, USA:ACM Press, 2014:620-627.
[20] ABOKHODAIR N, YOO D, MCDONALD D W.Dissecting a social botnet:growth, content and influence in Twitter[C]//Proceedings of the 18th ACM Conference on Computer Supported Cooperative Work &Social Computing.New York, USA:ACM Press, 2015:839-851.
[21] TANNER B K, WARNER G, STERN H, et al.Koobface:The evolution of the social botnet[C]//Proceedings of 2010 eCrime Researchers Summit.Washington D.C., USA:IEEE Press, 2010:1-10.
[22] BOSHMAF Y, MUSLUKHOV I, BEZNOSOV K, et al.Design and analysis of a social botnet[J].Computer Networks, 2013, 57(2):556-578.
[23] 何毓锟.社交网络僵尸研究[D].长春:吉林大学, 2015. HE Y K.Research on bot of social networks[D].Changchun:Jilin University, 2015.(in Chinese)
[24] CALLADO A, KELNER J, SADOK D, et al.Better network traffic identification through the independent combination of techniques[J].Journal of Network and Computer Applications, 2010, 33(4):433-446.
[25] KARTALTEPE E J, MORALES J A, XU S H, et al.Social network-based botnet command-and-control:emerging threats and countermeasures[C]//Proceedings of ACM Conference on Applied Cryptography and Network Security.New York, USA:ACM Press, 2010:511-528.
[26] 李跃, 翟立东, 王宏霞, 等.一种基于社交网络的移动僵尸网络研究[J].计算机研究与发展, 2012, 49(S2):1-8. LI Y, ZHAI L D, WANG H X, et al.Mobile botnet based on SNS[J].Journal of Computer Research and Development, 2012, 49(S2):1-8.(in Chinese)
[27] ZeroFox Research.Inside the massive SIREN social networkspam botnet[EB/OL].[2021-03-10].https://www.zerofox.com/blog/inside-massive-siren-social-network-spam-botnet/.
[28] SINGH A, TODERICI A H, ROSS K, et al.Social networking for botnet command and control[J].International Journal of Computer Network and Information Security, 2013, 5(6):11-17.
[29] GAO J, LIU M.A study on social network based P2P botnet[J].Science, 2017, 2(3):204-208.
[30] JSteg[EB/OL].[2021-03-10].http://zooid.org/~paul/crypto/jsteg/.
[31] SOLANKI K, SARKAR A, MANJUNATH B S.YASS:yet another steganographic scheme that resists blind steganalysis[C]//Proceedings of International Workshop on Information Hiding.Berlin, Germany:Springer, 2007:16-31.
[32] SALLEE P.Model-based methods for steganography and steganalysis[J].International Journal of Image and Graphics, 2005, 5(1):167-189.
[33] PROVOS N.Defending against statistical steganalysis[EB/OL].[2021-03-10].https://hdl.handle.net/2027.42/107890.
[34] WESTFELD A.F5-A steganographic algorithm[C]//Proceedings of the 4th International Workshop on Information Hiding.Berlin, Germany:Springer, 2001:289-302.
[35] DESOKY A.Noiseless steganography:the key to covert communications[M].[S.1.]:CRC Press, 2012.
[36] SEBASTIAN S, AYYAPPAN S, VINOD P.Framework for design of Graybot in social network[C]//Proceedings of 2014 International Conference on Advances in Computing, Communications and Informatics.Washington D.C., USA:IEEE Press, 2014:2331-2336.
[37] COMPAGNO A, CONTI M, LAIN D, et al.Boten ELISA:a novel approach for botnet C&C in online social networks[C]//Proceedings of 2015 IEEE Conference on Communications and Network Security.Washington D.C., USA:IEEE Press, 2015:74-82.
[38] BRONIATOWSKI D A, JAMISON A M, QI S H, et al.Weaponized health communication:Twitter bots and Russian trolls amplify the vaccine debate[J].American Journal of Public Health, 2018, 108(10):1378-1384.
[39] LUCERI L, DEB A, GIORDANO S, et al.Evolution of bot and human behavior during elections[J].First Monday, 2019, 24(9):1-29.
[40] VERKAMP J P, MALSHE P, GUPTA M, et al.Facebot:an undiscoverable botnet based on treasure hunting social networks[EB/OL].[2021-03-10].http://research.jverkamp.com/.
[41] CHU Z, GIANVECCHIO S, KOEHL A, et al.Blog or block:detecting blog bots through behavioral biometrics[J].Computer Networks, 2013, 57(3):634-646.
[42] YAN G H.Peri-watchdog:hunting for hidden botnets in the periphery of online social networks[J].Computer Networks, 2013, 57(2):540-555.
[43] XUE J L, YANG Z, YANG X Y, et al.VoteTrust:Leveraging friend invitation graph to defend against social network Sybils[C]//Proceedings of IEEE INFOCOMʼ13.Washington D.C., USA:IEEE Press, 2013:2400-2408.
[44] FERRARA E, VAROL O, DAVIS C, et al.The rise of social bots[J].Communications of the ACM, 2016, 59(7):96-104.
[45] XIA H, LI L, CHENG X G, et al.Modeling and analysis botnet propagation in social Internet of things[J].IEEE Internet of Things Journal, 2020, 7(8):7470-7481.
[46] TAN E H, GUO L, CHEN S Q, et al.Spammer behavior analysis and detection in user generated content on social networks[C]//Proceedings of the 32nd IEEE International Conference on Distributed Computing Systems.Washington D.C., USA:IEEE Press, 2012:305-314.
[47] CHU Z, GIANVECCHIO S, WANG H N, et al.Detecting automation of Twitter accounts:are you a human, bot, or cyborg?[J].IEEE Transactions on Dependable and Secure Computing, 2012, 9(6):811-824.
[48] BRITO F, PETIZ I, SALVADOR P, et al.Detecting social-network bots based on multiscale behavioral analysis[C]//Proceedings of IEEE International Conference on Emerging Security Information, Systems, and Technologies.Washington D.C., USA:IEEE Press, 2013:4578-4586.
[49] GAO H Y, HU J, WILSON C, et al.Detecting and characterizing social spam campaigns[C]//Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement.New York, USA:ACM Press, 2010:35-47.
[50] CAO L, QIU X F.ASP2P:an advanced botnet based on social networks over hybrid P2P[C]//Proceedings of the 22nd Wireless and Optical Communication Conference.Chongqing, China:[s.n.], 2013:677-682.
[51] FAGHANI M R, NGUYEN U T.Socellbot:a new botnet design to infect smartphones via online social networking[C]//Proceedings of the 25th IEEE Canadian Conference on Electrical and Computer Engineering.Washington D.C., USA:IEEE Press, 2012:1-5.
[52] YANG Z, WILSON C, WANG X, et al.Uncovering social network Sybils in the wild[J].ACM Transactions on Knowledge Discovery from Data, 2014, 8(1):1-29.
[53] CAO Q, YANG X W, YU J Q, et al.Uncovering large groups of active malicious accounts in online social networks[C]//Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security.New York, USA:ACM Press, 2014:477-488.
[54] JIANG M, CUI P, BEUTEL A, et al.CatchSync:catching synchronized behavior in large directed graphs[C]//Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining.New York, USA:ACM Press, 2014:941-950.
[55] BURGHOUWT P, SPRUIT M, SIPS H.Towards detection of botnet communication through social media by monitoring user activity[C]//Proceedings of International Conference on Information Systems Security.Berlin, Germany:Springer, 2011:131-143.
[56] JI Y D, HE Y K, JIANG X Y, et al.Combating the evasion mechanisms of social bots[J].Computers and Security, 2016, 58:230-249.
[57] 徐华露, 汤娟, 刘嘉勇.基于随机森林的微博僵尸账号检测研究[J].现代计算机, 2020(30):16-20. XU H L, TANG J, LIU J Y.Research on detecting zombie accounts using random forest[J].Modern Computer, 2020(30):16-20.(in Chinese)
[58] TAN E H, GUO L, CHEN S Q, et al.Spammer behavior analysis and detection in user generated content on social networks[C]//Proceedings of the 32nd IEEE International Conference on Distributed Computing Systems.Washington D.C., USA:IEEE Press, 2012:305-314.
[59] JI Y D, HE Y K, JIANG X Y, et al.Towards social botnet behavior detecting in the end host[C]//Proceedings of the 20th IEEE International Conference on Parallel and Distributed Systems.Washington D.C., USA:IEEE Press, 2014:320-327.
[60] NATARAJAN V, SHEEN S N, ANITHA R.Detection of StegoBot:a covert social network botnet[C]//Proceedings of the 1st International Conference on Security of Internet of Things.Washington D.C., USA:IEEE Press, 2012:36-41.
[61] GHANADI M, ABADI M.SocialClymene:a negative reputation system for covert botnet detection in social networks[C]//Proceedings of the 7th International Symposium on Telecommunications.Washington D.C., USA:IEEE Press, 2014:954-960.
[62] FRIDRICH J, GOLJAN M, HOGEA D.Steganalysis of JPEG images:breaking the F5 algorithm[C]//Proceedings of International Conference on Information Hiding.Berlin, Germany:Springer, 2002:310-323.
[63] VENKATACHALAM N, ANITHA R.A multi-feature approach to detect stegobot:a covert multimedia social network botnet[J].Multimedia Tools and Applications, 2017, 76(4):6079-6096.
[64] KODOVSKY J, FRIDRICH J, HOLUB V.Ensemble classifiers for steganalysis of digital media[J].IEEE Transactions on Information Forensics and Security, 2012, 7(2):432-444.
[65] NATARAJAN V, ANITHA R.Universal steganalysis using contourlet transform[M].Berlin, Germany:Springer, 2012.
[66] FIRE M, KATZ G, ELOVICI Y.Strangers intrusion detection-detecting spammers and fake proles in social networks based on topology anomalies[EB/OL].[2021-03-10].https://www.researchgate.net/publication/258513228.
[67] NATARAJAN V, SHEEN S N, ANITHA R.Multilevel analysis to detect covert social botnet in multimedia social networks[J].The Computer Journal, 2014, 58(4):679-687.
[68] SAKAKI T, OKAZAKI M, MATSUO Y.Earthquake shakes Twitter users:real-time event detection by social sensors[C]//Proceedings of the 19th International Conference on World Wide Web.Washington D.C., USA:IEEE Press, 2010:851-860.
[69] TRACY E M, WHITTAKER J K.The social network map:assessing social support in clinical practice[J].Families in Society:the Journal of Contemporary Social Services, 1990, 71(8):461-470.
[70] YADAV S, REDDY A K K, REDDY A L N, et al.Detecting algorithmically generated malicious domain names[C]//Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement.New York, USA:ACM Press, 2010:48-61.
[71] BORGELT C, KRUSE R.Induction of association rules:apriori implementation[M].[S.1.]:Physica-Verlag, 2002.
[72] DORRI A, ABADI M, DADFARNIA M.SocialBotHunter:botnet detection in Twitter-like social networking services using semi-supervised collective classification[C]//Proceedings of the 16th IEEE International Conference on Dependable, Autonomic and Secure Computing.Washington D.C., USA:IEEE Press, 2018:496-503.
[73] LINGAM G, ROUT R R, SOMAYAJULU D, et al.Social botnet community detection:a novel approach based on behavioral similarity in Twitter network using deep learning[C]//Proceedings of the 15th ACM Conference on Computer and Communications Security.New York, USA:ACM Press, 2020:708-718.
[74] ABULAISH M, FAZIL M.Socialbots:impacts, threat-dimensions, and defense challenges[J].IEEE Technology and Society Magazine, 2020, 39(3):52-61.
[75] ZHANG W Z, ZHANG B, ZHOU Y, et al.An IoT honeynet based on multiport honeypots for capturing IoT attacks[J].IEEE Internet of Things Journal, 2020, 7(5):3991-3999.
[76] OLIVERI A, LAURIA F.Sagishi:an undercover software agent for infiltrating IoT botnets[J].Network Security, 2019(1):9-14.
[77] AHMED Z, DANISH S M, QURESHI H K, et al.Protecting IoTs from mirai botnet attacks using blockchains[C]//Proceedings of the 24th IEEE International Workshop on Computer Aided Modeling and Design of Communication Links and Networks.Washington D.C., USA:IEEE Press, 2019:1-6.
[78] YIN D, ZHANG L M, YANG K.A DDoS attack detection and mitigation with software-defined Internet of things framework[J].IEEE Access, 2018, 6:24694-24705.
[79] THANH VU S N, STEGE M, EL-HABR P I, et al.A survey on botnets:incentives, evolution, detection and current trends[J].Future Internet, 2021, 13(8):198.
[80] 王天佐, 王怀民, 刘波, 等.僵尸网络中的关键问题[J].计算机学报, 2012, 35(6):1192-1208. WANG T Z, WANG H M, LIU B, et al.Some critical problems of botnets[J].Chinese Journal of Computers, 2012, 35(6):1192-1208.(in Chinese)

选择文件类型/文献管理软件名称

选择包含的内容