| 摘要(英) |
A group of bots, referred to as a botnet, is remotely controllable by a server and can be used for sending spam mails, stealing personal information, and launching DDoS attacks. Botnets are evolved from malicious program, its features are providing the attacker secret, flexibility and very powerful capability.
IRC is the most common botnet commend and control mechanism because it is scalable and easy to hide within. So in this paper, we focus on the IRC-based virus, using DNS hijacking technology to converge computers infected with botnet virus, this way is to monopolize the connection between hackers. Then figure out hackers how to control bots via traffic analysis. Our results show that bots traffic can be filtering and redirection, and we also can give bot client assistance in clean virus up.
|
| 參考文獻 |
[1]J. Oikarinen and D. Reed, “Internet relay chat protocol.” RFC 1459, 1993.
[2]Evan Cooke, Farnam Jahanian, Danny McPherson, “The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets. ” In Usenix Workshop on Steps to Reducing Unwanted Traffic on the Internet , June 2005.
[3]Nicole Immorlica, Kamal Jain, Mohammad Mahdian, and Kunal Talwar, “Click Fraud Resistant Methods for Learning Click-Through Rates.”Lecture Notes In Computer Science. Springer-Verlag, New York, 34–45.
[4]M. Overton, “Bots and botnets,” in Virus Bulletin 2005, Oct 2005.
[5]Damballa,http://www.damballa.com/
[6]C. Kalt, “Internet Relay Chat: Architecture.” RFC 2810, 2000
[7]Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose and Andreas Terzis, ”A Multifaceted Approach to Understanding the Botnet Phenomenon,” In IMC’06, October 25–27, 2006, Rio de Janeiro, Brazil
[8]Hyunsang Choi, Hanwoo Lee, Heejo Lee and Hyogon Kim, ” Botnet Detection by Monitoring Group Activities in DNS Traffic,” in Proc. 7th IEEE International Conference on Computer and Information Technology, 2007, pp. 715–720.
[9]Carl Livadas, Bob Walsh, David Lapsley and Tim Strayer, “Using Machine Learning Techniques to Identify Botnet Traffic,” In 2nd IEEE LCN Workshop on Network Security (WoNS'2006), 2006.
[10]涂浩,李之棠和周麗娟,"基於DNS通信數據挖掘的Botnet檢測方法研究,"發表在廈門大學核心期刊學報(自然科學版), 2007年第z2期
[11]W. W. Cohen, “Fast effective rule induction. In ICML,” pages 115-123, 1995.
[12]ThreatExpert , http://www.threatexpert.com/
[13]Craig Schiller and Jim Binkley, “ Botnets：The Killer Web App.”Syngress 2006.
|
[Endnote RIS 格式]
[相關文章]
[文章引用]
[完整記錄]
[館藏目錄]
[檢視]
plurk
funp
live
udn
HD
myshare
netvibes
friend
youpush
delicious
baidu
Google bookmarks
del.icio.us
hemidemi
facebook
twitter
google
reddit