• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>4th ACM symposium on information, computer and communications security 2009 >Towards Complete Node Enumeration in a Peer-to-Peer Botnet
【24h】

Towards Complete Node Enumeration in a Peer-to-Peer Botnet

机译：在对等僵尸网络中实现完整的节点枚举

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Modern advanced botnets may employ a decentralized peer-to-peer overlay network to bootstrap and maintain their command and control channels, making them more resilient to traditional mitigation efforts such as server incapacitation. As an alternative strategy, the malware defense community has been trying to identify the bot-infected hosts and enumerate the IP addresses of the participating nodes so that the list can be used by system administrators to identify local infections, block spam emails sent from bots, and configure firewalls to protect local users. Enumerating the infected hosts, however, has presented challenges. One cannot identify infected hosts behind firewalls or NAT devices by employing crawlers, a commonly used enumeration technique where recursive get-peerlist lookup requests are sent newly discovered IP addresses of infected hosts. As many bot-infected machines in homes or offices are behind firewall or NAT devices, these crawler-based enumeration methods would miss a large portions of botnet infections. In this paper, we present the Passive P2P Monitor (PPM), which can enumerate the infected hosts regardless whether or not they are behind a firewall or NAT. As an empirical study, we examined the Storm botnet and enumerated its infected hosts using the PPM. We also improve our PPM design by incorporating a Fire Wall Checker (FWC) to identify nodes behind a firewall. Our experiment with the peer-to-peer Storm botnet shows that more than 40% of bots that contact the PPM are behind firewall or NAT devices, implying that crawler-based enumeration techniques would miss out a significant portion of the botnet population. Finally, we show that the PPM's coverage is based on a probability-based coverage model that we derived from the empirical observation of the Storm botnet.
机译：现代先进的僵尸网络可能会采用分散的对等覆盖网络来引导和维护其命令和控制通道，从而使其对诸如服务器能力丧失之类的传统缓解措施更具弹性。作为一种替代策略，恶意软件防御社区一直在尝试识别感染了僵尸程序的主机，并枚举参与节点的IP地址，以便系统管理员可以使用该列表来识别本地感染，阻止从僵尸程序发送的垃圾邮件，并配置防火墙以保护本地用户。但是，枚举受感染的主机带来了挑战。人们无法通过采用搜寻器来识别防火墙或NAT设备后面的受感染主机，这是一种常用的枚举技术，在该技术中，递归的获取对等表查找请求会发送给被感染主机的新发现的IP地址。由于家庭或办公室中许多被僵尸病毒感染的计算机都位于防火墙或NAT设备后面，因此这些基于爬网程序的枚举方法会遗漏大部分僵尸网络感染。在本文中，我们介绍了被动P2P监视器（PPM），它可以枚举受感染的主机，无论它们是否位于防火墙或NAT之后。作为一项实证研究，我们检查了Storm僵尸网络，并使用PPM枚举了其感染的主机。我们还通过合并防火墙检查器（FWC）来识别防火墙后面的节点，从而改进了PPM设计。我们对等Storm僵尸网络的实验表明，与PPM联系的僵尸网络中有40％以上的僵尸网络位于防火墙或NAT设备之后，这意味着基于爬虫的枚举技术会遗漏大量僵尸网络。最后，我们证明PPM的覆盖率基于基于概率的覆盖率模型，该模型是从Storm僵尸网络的经验观察得出的。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号