CT-ISG: Understanding Botnet Command and Control (C&C) Communication

美国国家科学基金会网络信托项目提案编号：0831160首席研究员：江绪贤机构：乔治梅森大学提案标题：CT-ISG：理解僵尸网络指挥与控制（C&amp；C）通信项目摘要僵尸网络被认为是当今互联网最严重的威胁之一。为了打击它们，一个关键步骤是有效地了解僵尸网络成员如何相互通信。不幸的是，在最近的机器人中采用各种混淆方案（例如加密）的趋势极大地阻碍了我们的理解。本研究的主要目的是研究几个相互关联的关键技术，以克服上述挑战，并显著丰富对僵尸网络命令和控制的理解。具体来说，本工作从以下观察中引入了一种称为上下文感知机器人执行监控的方法：(1)实现机器人通信协议，机器人程序包含它将遵循的权威协议逻辑以及它可以处理的机器人消息的最终规范；(2) bot通常在不同的执行环境下处理bot消息的不同字段（例如，使用不同的运行时调用堆栈）。因此，本研究将收集、描述和分析带有执行上下文信息的跟踪，以辨别各种协议字段以及bot消息中的相关语义。本研究的广泛影响是双重的：(1)它不仅通过观察和推断机器人之间的网络级交互，而且通过揭示详细的机器人交互背后的僵尸网络C&amp；C通信协议逻辑，将显著丰富对僵尸网络威胁的理解。(2)本研究的结果还将用于开发本科和研究生课程以及专业培训课程的教材。这项工作的智力价值包括一种新的方法来逆向工程僵尸网络C&amp；C通信协议。

National Science FoundationNSF Cyber Trust ProgramProposal Number: 0831160Principal Investigator: Xuxian JiangInstitution: George Mason UniversityProposal Title: CT-ISG: Understanding Botnet Command and Control (C&C) CommunicationProject SummaryBotnets are recognized as one of the most serious threats to today's Internet. To combat them, one key step is to effectively understand how the botnet members communicate with each other. Unfortunately, the trend of adopting various obfuscation schemes (e.g., encryption) in recent bots greatly impedes our understanding. The main thrust of this research is the investigation of several interrelated key techniques to overcome the above challenges and significantly enrich the understanding of botnet command and control. Specifically, this work introduces a methodology called context-aware bot execution monitoring, from the following observations: (1) implementing the bot communication protocol, a bot program contains the authoritative protocol logic it will follow to respond and the ultimate specification of the bot messages it can handle; (2) a bot typically handles different fields of the bot message under different execution contexts, (e.g., with different run-time call stacks). As such, this research will collect, characterize, and analyze traces with execution context information to discern various protocol fields as well as associated semantics in the bot message. The broader impact of this research is two-fold: (1) It will significantly enrich the understanding of the botnet threat by not only observing and inferring the network-level interactions among bots, but also exposing the botnet C&C communication protocol logic behind detailed bot interactions. (2) Results from this research will also lead to the development of education materials for undergraduate and graduate courses and for professional training sessions. Intellectual merit of the work includes a novel approach to reverse engineering the botnet C&C communications protocol.