新型对等式僵尸网络的检测与抑制关键技术研究

Nowadays, P2P technologies are continually introduced into the construction and C&C mechanisms of botnets, which makes P2P botnets gradually become the most important pattern of botnets. P2P botnets not only have good controllability and large scale like traditional centralized botnets, but also are dramatically improved in the stealthiness and resiliency. As a result, P2P botnets propose a big challenge for the research on detection and mitigation of botnets..In response to the challenge brought by the stealthiness and resiliency, we will study the detection and mitigation technology of novel P2P botnets. Based on the optimized node enumeration and topology exploration method, we will solve the critical problems of the directional infiltration and importance enhancement for probing nodes, in order to obtain the capability of monitoring and influencing large P2P networks. In face of the stealthiness of novel P2P botnets, based on the monitoring capability of probing nodes, we will study how to discover the most searched targets in P2P networks, as well as how to find out the indexes of C&C information in P2P networks, so as to detect bots coompletely and concisely. In face of the high resiliency of P2P botnets, we will study how to ruin structures of botnets in the networking layer, how to deter the delivery of C&C informaion in the communicating layer, how to pollute the content of C&C information in the contenting layer, so as to construct a technology system of mitigation. The results of our study will provide critical support for the detection and mitigation of novel P2P botnets.

随着攻击者不断地在僵尸网络中引入分布式的组网、命令与控制结构，对等式僵尸网络逐渐成为僵尸网络的主要形态，不仅保持集中式僵尸网络的控制能力和规模特性，其隐蔽性和抗毁性也得到极大提高，对僵尸网络的检测与抑制提出巨大挑战。.课题围绕破击寄生型对等式僵尸网络的隐蔽性和抗毁性，深入研究新型僵尸网络的检测与抑制：以优化的对等网络节点遍历与结构探测为基础，突破探针节点的定向渗透与重要性提升等技术难题，形成监测并影响大规模对等网络活动的技术能力。以适量探针节点为支撑，感知对等网络的热门搜索活动，分析发现隐蔽寄生于其中的僵尸网络命令与控制信息流向，全面、准确检测僵尸节点。鉴于对等式僵尸网络抗毁性强的结构特性，研究在组网层破坏僵尸网络结构、在可达层破坏命令与控制信息传递、在内容层破坏命令与控制信息含义的技术难题，构建对等式僵尸网络综合抑制体系。课题研究成果将为有效应对新型僵尸网络威胁提供重要的关键技术支撑。

僵尸网络在攻击者有组织的操控下，可以凭借其掌握的大量网络资源，对网络信息系统安全构成巨大威胁，其典型危害主要包括发动DDoS攻击、发送垃圾邮件、窃取用户隐私、为恶意站点或应用提供Fast Flux保护等。同时，随着各种社交网络应用及服务的大规模兴起，以其为寄生环境，僵尸网络又日渐深入地被攻击者用于传播谣言、欺诈等不良信息，以达到其影响受众心理认知、引导网络舆论走向等攻击意图，日益成为对网络内容安全的全新严重威胁。为此，本项目展开以下研究：提出一种层次化的僵尸网络检测与抑制体系结构，包括基础层、支撑层、核心层和应用层四个层面。在基础层，研究对等网络和社交网络的节点枚举与结构探测，为僵尸网络检测与抑制提供网络拓扑知识；在支撑层，研究探针节点的定向渗透与重要性提升、社交节点属性与行为分析、信息传播路径分析等技术，为僵尸网络检测与抑制提供节点信息流向、属性画像、索引与路径等重要信息；在核心层，研究僵尸网络结构分析、搜索热点感知、命令与控制信息流向分析、污染与破坏等技术，为寄生型对等僵尸网络和社交僵尸网络的检测与抑制提供核心技术支撑；在应用层，研究面向命令搜索过程、命令发布过程的抑制技术，有效抑制结构化僵尸网络的搜索活动和内容发布过程，从而形成僵尸网络的综合检测和抑制体系。