【24h】

Your Botnet is My Botnet: Analysis of a Botnet Takeover

机译:您的僵尸网络是我的僵尸网络:分析僵尸网络收购

获取原文

摘要

Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security problems on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the Torpig botnet and study its operations for a period of ten days. During this time, we observed more than 180 thousand infections and recorded almost 70 GB of data that the bots collected. While botnets have been "hijacked" and studied previously, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of data from the infected victims. This data provides a new understanding of the type and amount of personal information that is stolen by botnets.
机译:僵尸网络,由对手控制的恶意软件感染机器的网络是互联网上大量安全问题的根本原因。一种特别复杂的和绝对的机器人类型是Torpig,一个恶意软件程序,旨在从受害者收获敏感信息(如银行账户和信用卡数据)。在本文中,我们报告了我们努力控制Torpig Botnet并研究其运营为期十天。在此期间,我们观察到超过18万感染,并记录了机器人收集的近70 GB的数据。虽然僵尸网络已经“被劫持”并以前研究,但Torpig僵尸网络表现出某些属性,以便分析数据特别有趣。首先,可以(具有合理的准确性)来识别唯一的机器人感染,并将该号码与联系我们的命令和控制服务器的超过120万个IP地址相关联。其次,Torpig僵尸网络大,目标是各种应用,从受感染的受害者中收集丰富而多样化的数据集。此数据提供了对被僵尸网络窃取的个人信息的类型和数量的新了解。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱:kefu@zhangqiaokeyan.com

京公网安备:11010802029741号 ICP备案号:京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有
  • 客服微信

  • 服务号