CT-ISG: Understanding Botnet Command and Control (C&C) Communication

国家科学基金国家科学基金网络信任项目提案编号：0831160主要调查者：徐县江所：乔治梅森大学提案题目：CT-ISG：理解僵尸网络指挥与控制(C&A；C)通信项目摘要僵尸网络被认为是当今互联网最严重的威胁之一。要打击它们，关键的一步是有效地了解僵尸网络成员之间的通信方式。不幸的是，在最近的机器人中采用各种混淆方案(例如，加密)的趋势极大地阻碍了我们的理解。这项研究的主旨是研究几个相互关联的关键技术，以克服上述挑战，并显著丰富对僵尸网络指挥和控制的理解。具体地说，这项工作引入了被称为上下文感知BOT执行监视的方法，来自以下观察：(1)实现BOT通信协议，BOT程序包含它将遵循的权威协议逻辑和它可以处理的BOT消息的最终规范；(2)BOT通常在不同的执行上下文下(例如，利用不同的运行时调用堆栈)处理BOT消息的不同字段。因此，本研究将收集、表征和分析带有执行上下文信息的跟踪，以识别BOT消息中的各种协议字段以及关联的语义。这项研究的更广泛的影响有两个方面：(1)它不仅可以观察和推断僵尸之间的网络级交互，还可以揭示详细的僵尸交互背后的僵尸网络C&C通信协议逻辑，从而极大地丰富对僵尸网络威胁的理解。(2)这项研究的结果还将导致为本科生和研究生课程以及专业培训课程编写教材。这项工作的智力价值包括一种对僵尸网络C&A；C通信协议进行逆向工程的新方法。

National Science FoundationNSF Cyber Trust ProgramProposal Number: 0831160Principal Investigator: Xuxian JiangInstitution: George Mason UniversityProposal Title: CT-ISG: Understanding Botnet Command and Control (C&C) Communication Project Summary Botnets are recognized as one of the most serious threats to today's Internet. To combat them, one key step is to effectively understand how the botnet members communicate with each other. Unfortunately, the trend of adopting various obfuscation schemes (e.g., encryption) in recent bots greatly impedes our understanding. The main thrust of this research is the investigation of several interrelated key techniques to overcome the above challenges and significantly enrich the understanding of botnet command and control. Specifically, this work introduces a methodology called context-aware bot execution monitoring, from the following observations: (1) implementing the bot communication protocol, a bot program contains the authoritative protocol logic it will follow to respond and the ultimate specification of the bot messages it can handle; (2) a bot typically handles different fields of the bot message under different execution contexts, (e.g., with different run-time call stacks). As such, this research will collect, characterize, and analyze traces with execution context information to discern various protocol fields as well as associated semantics in the bot message. The broader impact of this research is two-fold: (1) It will significantly enrich the understanding of the botnet threat by not only observing and inferring the network-level interactions among bots, but also exposing the botnet C&C communication protocol logic behind detailed bot interactions. (2) Results from this research will also lead to the development of education materials for undergraduate and graduate courses and for professional training sessions. Intellectual merit of the work includes a novel approach to reverse engineering the botnet C&C communications protocol.