NETS: Small: Exploiting Social Communication Channels Against Cyber Criminals

恶意软件，尤其是僵尸网络，已经成为互联网上大多数攻击和恶意活动的主要来源。机器人与其他机器人和命令控制服务器进行通信，以协调它们的恶意活动。该项目正在开发新的技术和工具，通过分析其通信渠道来检测恶意活动和僵尸网络。该项目计划通过几种新颖的机制来研究检测这些通信渠道的机制：(i)通过社会联系的图形分析，（ii）分析通信的图形属性来破译机器人的点对点通信属性，以及（iii）基于机器学习的方法来分析网络流量。传播恶意内容和恶意软件所需的自动化将导致这些通信通道中的行为与人类行为不同。我们希望生成的名称、内容、联系和通信的时间、社交图结构足够不同，使我们能够开发检测恶意实体的技术。我们的工作重点是开发健壮的技术，当僵尸网络试图逃避检测机制时，这些技术很难逃避或限制僵尸网络的功能。开发的分析工具将有助于检测网络中的僵尸网络和社交网络中的恶意实体。教育影响将包括培养研究生和本科生有价值的研究技能，同时推进网络安全和流量分析的最新状态，为技术劳动力做出贡献。我们将公布我们的结果，并使技术转移到工业。

Malware, especially botnets, have become the main source of most attacks and malicious activities on Internet. Bots communicate with each other and Command & Control servers to coordinate their malicious activities. This project is developing new techniques and tools to detect malicious activities and botnets through analyzing their communication channels. This project plans to investigate mechanisms for detecting these communication channels through several novel mechanisms: (i) through a graph analysis of social contacts, (ii) analyzing graph properties of communication to decipher Peer to peer communication properties of bots and (iii) machine learning based approaches to analyzing network traffic. The automation required to propagate malicious contents and malware will result in different behavior than human behavior in these communication channels. We expect the generated names, content, the time of contacts and communication, the social graph structures to be sufficiently different to enable us to develop techniques for detection of malicious entities. Our work focuses on developing robust techniques that are hard to evade or limit the botnet functions when they try to evade the detection mechanisms. Developed analysis tools will help in detecting botnets in networks and malicious entities in social networks. Educational impact will include training graduate and undergraduate students with valuable research skills while advancing the state of the art in network security and traffic analysis, contributing to the technology workforce. We will publish our results and enable technology transfer to industry.