NETS: Small: Exploiting Social Communication Channels Against Cyber Criminals

恶意软件，特别是僵尸网络，已经成为互联网上大多数攻击和恶意活动的主要来源。机器人之间相互通信，并与命令和控制服务器进行通信，以协调它们的恶意活动。该项目正在开发新的技术和工具，通过分析恶意活动和僵尸网络的通信渠道来检测它们。这个项目计划通过几种新的机制来研究检测这些通信通道的机制：(I)通过社交联系的图形分析，(Ii)分析通信的图形属性来破译机器人的对等通信属性，以及(Iii)基于机器学习的方法来分析网络流量。传播恶意内容和恶意软件所需的自动化将导致与这些通信渠道中的人类行为不同的行为。我们希望生成的姓名、内容、联系和交流的时间以及社交图结构充分不同，从而使我们能够开发出检测恶意实体的技术。我们的工作集中在开发健壮的技术，当僵尸网络试图逃避检测机制时，它们很难逃避或限制僵尸网络功能。开发的分析工具将有助于检测网络中的僵尸网络和社交网络中的恶意实体。教育影响将包括培训具有宝贵研究技能的研究生和本科生，同时促进网络安全和流量分析方面的最新水平，为技术劳动力做出贡献。我们将公布我们的结果，并允许向行业转让技术。

Malware, especially botnets, have become the main source of most attacks and malicious activities on Internet. Bots communicate with each other and Command & Control servers to coordinate their malicious activities. This project is developing new techniques and tools to detect malicious activities and botnets through analyzing their communication channels. This project plans to investigate mechanisms for detecting these communication channels through several novel mechanisms: (i) through a graph analysis of social contacts, (ii) analyzing graph properties of communication to decipher Peer to peer communication properties of bots and (iii) machine learning based approaches to analyzing network traffic. The automation required to propagate malicious contents and malware will result in different behavior than human behavior in these communication channels. We expect the generated names, content, the time of contacts and communication, the social graph structures to be sufficiently different to enable us to develop techniques for detection of malicious entities. Our work focuses on developing robust techniques that are hard to evade or limit the botnet functions when they try to evade the detection mechanisms. Developed analysis tools will help in detecting botnets in networks and malicious entities in social networks. Educational impact will include training graduate and undergraduate students with valuable research skills while advancing the state of the art in network security and traffic analysis, contributing to the technology workforce. We will publish our results and enable technology transfer to industry.