基于蜜罐的Mirai僵尸网络追踪技术研究  

Research on Mirai Botnet Tracking Technology based on Honeypot

作　　者：杜逊 吴越[1] 邹福泰[1] 李林森[1] DU Xun;WU Yue;ZOU Fu-tai;LI Lin-sen(School of Cyberspace Security,Shanghai Jiao Tong University,Shanghai 200240,China)

机构地区：[1]上海交通大学网络空间安全学院

出　　处：《通信技术》2019年第12期3027-3031,共5页Communications Technology

基　　金：国家重点研发计划项目课题（No.2018YFB0803503)~~

摘　　要：近年来,基于物联网设备的僵尸网络呈现增长性趋势,其中2016至2017年爆发的Mirai僵尸网络导致多个网站受到攻击。同时,由于物联网设备的计算能力弱,导致对于攻击的追踪难度提高,通过对Mirai样本及源码的分析,根据Mirai的攻击指令模式,提出基于蜜罐的Mirai僵尸网络追踪技术成为研究热点之一。通过对蜜罐的数据包解析分析,能够达到分析出攻击指令及追踪攻击指令来源的目的。实验结果表明,基于蜜罐的追踪系统能够准确的分析攻击指令,并追踪物联网设备僵尸网络的攻击来源。In recent years,botnets based on IoT devices have shown a growing trend,with the Mirai botnet that broke out between 2016 and 2017 causing multiple websites to be attacked.At the same time,due to the weak computing power of IoT devices,the tracking of attacks is more difficult.Therefore,through the analysis of Mirai botnet samples and source code,according to Mirai’s attack command mode,the Mirai botnet tracking technology based on honeypot is proposed.Through the analysis and analysis of the honeypot data packet,the purpose of analyzing the attack command and tracking the source of the attack command is achieved.In the experiment,the honeypot-based tracking system can accurately analyze the attack command and track the source of the attack.

关 键 词：蜜罐 Mirai僵尸网络 追踪技术 流量分析 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]