摘要
从僵尸程序执行轨迹对二进制代码块的覆盖规律出发,提出了一种僵尸网络控制命令发掘方法。通过分析执行轨迹对代码块的覆盖率特征实现对僵尸网络控制命令空间的发掘,根据代码空间是否被全覆盖来验证发现的僵尸网络命令空间的全面性。对僵尸网络Zeus、SdBot、AgoBot的执行轨迹进行了代码块覆盖率分析,结果表明,该方法能够快速准确地发掘出僵尸网络的控制命令集合,时间和空间开销小,且该命令集合所对应的执行轨迹可以覆盖僵尸程序95%以上的代码空间。
There are some inherent patterns in the bot execution trace coverage of basic blocks. Using these patterns, an approach was proposed to infer Botnet command-and-control protocol （C＆C protocol）. Without intermediate representa- tion of binary code and constraints solving, this approach has a lower time and space overhead. This coverage analysis approach was evaluated on 3 famous Botnet： Zeus, Sdbot and Agobot. The result shows that this approach can accurately and efficiently extract the Botnet control commands. And the completeness of the extracted control commands could be veri- fied by checking whether aU available basic blocks in bot are covered by the traces triggered by the control commands.
出处
《通信学报》
EI
CSCD
北大核心
2014年第1期156-166,共11页
Journal on Communications
基金
国家自然科学基金资助项目(61300242
61272423
60973141)
国家重点基础研究发展计划("973"计划)基金资助项目(2013CB834204)
中央高校基本科研业务费专项基金资助项目(65121012)
南开大学-腾讯联合基金资助项目(2011-11)~~
