• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>IEEE transactions on industrial informatics >ConnSpoiler: Disrupting C&C Communication of IoT-Based Botnet Through Fast Detection of Anomalous Domain Queries
【24h】

ConnSpoiler: Disrupting C&C Communication of IoT-Based Botnet Through Fast Detection of Anomalous Domain Queries

机译：ConnSpoiler：通过快速检测异常域查询来扰乱基于IOT的僵尸网络的C＆C通信

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The development of Internet of Things (IoT) dramatically facilitates the integration of computing systems with the physical world. However, as IoT devices are more easy to compromise than desktop computers, cybercriminals have founded IoT-based botnets to launch Distributed Denial of Service (DDoS) attacks with unprecedented traffic volume. To mitigate the damages associated with these attacks, the detection of IoT-based botnet has to preempt the command and control (C&C) communication to prevent the delivery of the attack codes. Motivated by the extensively implementation of domain generation algorithm in botnets, in this article, we propose ConnSpoiler, a lightweight system that detects IoT-based botnets by identifying the stream of algorithmically generated domains (AGDs) in a fast way. ConnSpoiler only needs negligible system resources to take effect and thus can execute well on the resource-restraint IoT devices. By outfitting a powerful statistical algorithm, i.e., threshold random walk, ConnSpoiler has a high probability (about 94%) of detecting infection before the compromised devices connect C&C servers, which can help to prevent the succeeding attacks. Moreover, ConnSpoiler only requires the benign domains to take effect and therefore does not need extra effort to label malicious samples for training phase. We evaluate ConnSpoiler based on real-world DNS traffics collected from two different large ISP networks and show that it accurately identifies devices that are compromised by unknown botnets.
机译：事物互联网（物联网）的发展显着促进了与物理世界的计算系统的整合。但是，由于IOT设备比桌面计算机更容易妥协，网络犯罪分子已创立基于IoT的僵尸网络，以推出具有前所未有的流量卷的分布式拒绝服务（DDOS）攻击。为了减轻与这些攻击相关的损害，基于IOT的僵尸网络的检测必须抢占命令和控制（C＆C）通信以防止攻击代码的传送。在本文中，通过僵尸网络中的域生成算法的广泛实现，我们提出了一种通过以快速方式识别算法生成的域（AGDS）流来检测基于IOT的僵尸网络的轻量级系统。 ConnSpoiler仅需要忽略不计的系统资源生效，因此可以在资源限制物联网设备上执行良好。通过推荐强大的统计算法，即阈值随机步道，ConnSpoiler在受损的设备连接C＆C服务器之前，ConnSpoiler具有高概率（约94％）检测感染，这有助于防止接下来的攻击。此外，ConnSpoiler仅需要良性域生效，因此不需要额外努力来标记恶意样本进行培训阶段。我们根据从两种不同的大型ISP网络收集的现实世界DNS流量来评估Connspoiler，并表明它准确地识别由未知Botnets受到损害的设备。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号