查詢結果分析
來源資料
頁籤選單縮合
題名 | 網路僵屍電腦之偵測系統的實作=Implementation of Zombie Detection System |
---|---|
作者 | 王平; 林文暉; 林孝忠; 黃財德; 李奇軒; | 書刊名 | 崑山科技大學學報 |
卷期 | 8 2011.06[民100.06] |
頁次 | 頁47-56 |
分類號 | 312.76 |
關鍵詞 | 僵屍網路; 僵屍電腦; 僵屍病毒; 情節法則; 疑似感染網址地圖; Botnet; Zombie; Bot; Episode rule; Zombie detection; |
語文 | 中文(Chinese) |
中文摘要 | 網路駭客運用僵屍網路(botnet)進行商業資訊的偷竊,造成企業及終端使用者重大威脅。僵屍電腦(zombies)具有隱密、不易偵測的特性,並使用不同的通訊協定進行操控,使得防火牆、防毒軟體難以完整偵測與清除。目前的僵屍病毒(bot)偵測技術主要依賴病毒碼(virus pattern) 與掃毒引擎進行比對。通常病毒碼是由多種特徵所組成,變種病毒(variant)稍加修改單一特徵後,即可能避開病毒碼的偵測;本研究使用沙盒工具SysAnalyzer觀察病毒的行為歷程,依據感染行為的順序及時間,透過頻繁情節(frequent episode)分析,歸納出共同病毒特徵及偵測準則,以建置「病毒特徵資料庫」,並估算病毒偵測之支持度(support)與信心度(confidence),以利檢測已知及其變種的僵屍病毒。為了證明本研究所提出之方法的可行性,實作完成一個「僵屍電腦偵測系統」及「疑似感染網址地圖」,運用成功大學資通安全測試平台(Testbed@TWISC)於仿真網路環境加以測試與驗證。實驗結果顯示本研究提出之方法可以有效及正確的地偵測出僵屍病毒,透過疑似感染網址地圖的監控,協助管理者快速掌控網路感染之僵屍電腦。 |
英文摘要 | Hackers used botnet to steal business information and led to serious threats for enterprises and end-users. Zombies can be manipulated by distinct protocols having features of stealthy, and difficult to be detected and cleaned, even using firewalls and anti-virus tools. The detection techniques of existing bots primarily used virus scan engine to scan via pattern matching matter. The variants can be formed by modifying virus signatures then they can be hardly detected. This work investigates virus behaviors via sandbox analysis and examines the common signatures of bots using frequent episodes for constructing a virus signature database with detection rules enhancement of estimation of support and confidence degree. Furthermore, a Zombie Detection System (ZDS) and a Dark IP Map have successfully been built to detect bots and variants. To validate the effectiveness of system, test cases in Testbed@TWISC are conducted to emulate network attacks scenario. Experimental results show that the proposed approach can effectively detect zombies and help managers rapidly monitor network zombies in a precise way. |
本系統之摘要資訊系依該期刊論文摘要之資訊為主。