高级检索
    金 鑫, 李润恒, 甘 亮, 李政仪. 基于通信特征曲线动态时间弯曲距离的IRC僵尸网络同源判别方法[J]. 计算机研究与发展, 2012, 49(3): 481-490.
    引用本文: 金 鑫, 李润恒, 甘 亮, 李政仪. 基于通信特征曲线动态时间弯曲距离的IRC僵尸网络同源判别方法[J]. 计算机研究与发展, 2012, 49(3): 481-490.
    Jin Xin, Li Runheng, Gan Liang, Li Zhengyi. IRC Botnets’ Homology Identifying Method Based on Dynamic Time Warping Distance of Communication Feature Curves[J]. Journal of Computer Research and Development, 2012, 49(3): 481-490.
    Citation: Jin Xin, Li Runheng, Gan Liang, Li Zhengyi. IRC Botnets’ Homology Identifying Method Based on Dynamic Time Warping Distance of Communication Feature Curves[J]. Journal of Computer Research and Development, 2012, 49(3): 481-490.

    基于通信特征曲线动态时间弯曲距离的IRC僵尸网络同源判别方法

    IRC Botnets’ Homology Identifying Method Based on Dynamic Time Warping Distance of Communication Feature Curves

    • 摘要: IRC僵尸网络(botnet)是攻击者通过IRC服务器构建命令与控制信道方式控制大量主机(bot)组成的网络.IRC僵尸网络中IRC服务器与bot连接具有很强的动态特性.相关研究采用IRC僵尸网络的服务器域名、服务器IP、控制者ID等信息度量IRC僵尸网络的相似性,再根据相似性值检测同源IRC僵尸网络,但这些信息并不能代表IRC僵尸网络的本质特征,因此误差较大.为识别使用不同IRC控制服务器的同源僵尸网络,提取僵尸网络的通信量特征曲线、通信频率特征曲线,基于通信特征曲线的动态时间弯曲距离判别同源的僵尸网络.为了减小计算量和增加判别准确率,根据通信特征曲线的特点,提取并利用曲线的峰、谷特征点;并提出改进的LB_PAA对动态时间弯曲距离的计算进行优化.实验验证了方法的有效性并计算了各类错误率.

       

      Abstract: IRC botnet can be regarded as a collection of compromised computers (called Zombie computers) running software under the commandandcontrol infrastructure constructed by IRC server. The connection between botnet server and bots are usually very dynamic. In order to describe a botnet at a finer granularity, some work identify homologous IRC botnets based on similarity of IRC botnets. The similarity of IRC botnets are measured by multidimensional data obtained from the infiltrated botnets, that is, some information, such as server version, IP address of IRC server, DNS name of IRC server, IRC server/network name, and botmaster ID, can be obtained by joining the command and control channel.Because such information doesn’t represent the essential characteristic of botnets, and with the upgrade of server version, obtaining the information such as botmaster ID becomes more difficult and the error ratio of the model is hard to be bounded. A method is proposed, which identifies homologous botnets by extracting communication feature curves and computs the dynamic time warping distance between the curves, distills and uses the feature points of communication curves to increase the precision, and uses improved LB_PAA to reduce calculated amount. Experiments were carried out and the error rates were evaluated and shown.

       

    /

    返回文章
    返回