基于域名的僵尸网络行为分析  

Analysis Botnet Behavior based on the Domain Name

作　　者：巫锡洪[1,2] 刘宝旭[2] 杨沛安[2] 

机构地区：[1]福州大学数学与计算机科学学院,福建福州350108 [2]中国科学院高能物理研究所计算中心,北京100049

出　　处：《信息网络安全》2013年第9期10-13,共4页Netinfo Security

基　　金：国家科技支撑计划[2012BAH14B02];国家发改委信息安全专项[发改办高技(2012)1424号]

摘　　要：域名系统作为互联网中最大的分布式系统,是连接用户和互联网的桥梁。但由于其自身协议的缺陷,不但出现了许多针对域名的恶意攻击行为,而且大量恶意行为还利用域名系统提高自身的生命力,如僵尸网络、网络钓鱼、垃圾邮件等。文章介绍了僵尸网络的内涵和域名流量数据特征,分析了基于域名系统的Fast-Flux和Domain-Flux网络工作方式和基本特征,并总结了目前效率比较高的Flux僵尸网络的检测算法。Domain Name System should be the largest distributed system. It is a bridge between the users and the Intemet. However, there are some defects in its protocols, which lead to many malicious attacks focus on DNS. Also, some malicious behaviors use these defects to make them stronger, such as Botnet, Phishing and Spamming. This paper introduced the characteristics of the content of Botnet and Domain flow data, which were found by a large amount of experiments, then studied the working modes and basic characteristics of the network based on Fast-Flux and Domain-Flux, at last concluded some of the most effective methods in the detection of Flux-Botnet.

关 键 词：域名系统 僵尸网络 Fast—Flux Domain—Flux 流量特征 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]