Good Bot, Bad Bot: Characterizing Automated Browsing Activity
Good Bot, Bad Bot: Characterizing Automated Browsing Activity
复制标题
DOI：
10.1109/sp40001.2021.00079
复制
发表时间：
2021-05
期刊：
影响因子：
--
通讯作者：
Xigao Li;Babak Amin Azad;Amir Rahmati;Nick Nikiforakis
中科院分区：
文献类型：
--
作者：
Xigao Li;Babak Amin Azad;Amir Rahmati;Nick Nikiforakis
随着网络规模的不断扩大，易受攻击和管理不善的网站数量也在不断增加。攻击者依靠大量恶意机器人来发现这些易受攻击的网站，损害其服务器并泄露敏感用户数据。因此，了解恶意机器人的数量和行为对网络安全至关重要。在本文中，我们报告了Aristaeus的设计、实现和结果，Aristaeus是一个用于部署大量“蜜点”的系统，即，仅以吸引和记录僵尸网络流量为目的的网站。通过对100个专用蜜站进行为期7个月的实验，Aristaeus记录了超过287 K个唯一IP地址发送的2640万个请求，其中76,396个请求属于明显的恶意机器人。通过分析这些机器人发送的请求类型和有效负载，我们发现平均每个蜜点每月收到超过37 K的请求，其中超过50%的请求试图暴力破解凭据，对部署的Web应用程序进行指纹识别，并利用大量不同的漏洞。通过将这些机器人的声明身份与其TLS握手和HTTP头进行比较，我们发现超过86.2%的机器人声称是Mozilla Firefox和Google Chrome，但构建在简单的HTTP库和命令行工具上。
As the web keeps increasing in size, the number of vulnerable and poorly-managed websites increases commensurately. Attackers rely on armies of malicious bots to discover these vulnerable websites, compromising their servers, and exfiltrating sensitive user data. It is, therefore, crucial for the security of the web to understand the population and behavior of malicious bots.In this paper, we report on the design, implementation, and results of Aristaeus, a system for deploying large numbers of "honeysites", i.e., websites that exist for the sole purpose of attracting and recording bot traffic. Through a seven-month-long experiment with 100 dedicated honeysites, Aristaeus recorded 26.4 million requests sent by more than 287K unique IP addresses, with 76,396 of them belonging to clearly malicious bots. By analyzing the type of requests and payloads that these bots send, we discover that the average honeysite received more than 37K requests each month, with more than 50% of these requests attempting to brute-force credentials, fingerprint the deployed web applications, and exploit large numbers of different vulnerabilities. By comparing the declared identity of these bots with their TLS handshakes and HTTP headers, we uncover that more than 86.2% of bots are claiming to be Mozilla Firefox and Google Chrome, yet are built on simple HTTP libraries and command-line tools.