基于猪笼草蜜罐的僵尸网络检测
Nepenthes Honeypots based Botnet Detection
摘要：
僵尸网络攻击的数量日益增多，对僵尸网络在网络中传播的检测变得非常具有挑战性。与普通恶意软件相比，僵尸程序具有特定的特征，因为它们由远程主服务器控制，并且通常不会像普通恶意软件那样显示其行为，直到它们没有从主服务器接收到任何命令。大多数时候僵尸恶意软件是不活动的，因此很难检测到。此外，检测或跟踪这些机器人的网络需要一个基础设施，该基础设施应该能够从各种数据源收集数据，并将数据关联起来，以便更全面地了解情况。在本文中，我们将分享我们的经验，僵尸网络检测在私有网络以及在公共区域部署猪笼草蜜罐。讨论了使用猪笼草进行恶意软件收集和使用反病毒扫描进行分析的自动化框架。最后给出了在网络中启用猪笼草蜜罐检测僵尸网络的实验结果。我们还看到，我们网络中现有的已知机器人可以被检测到。
英文摘要：
The numbers of the botnet attacks are increasing day by day and the detection of botnet spreading in the network has become very challenging. Bots are having specific characteristics in comparison of normal malware as they are controlled by the remote master server and usually dont show their behavior like normal malware until they dont receive any command from their master server. Most of time bot malware are inactive, hence it is very difficult to detect. Further the detection or tracking of the network of theses bots requires an infrastructure that should be able to collect the data from a diverse range of data sources and correlate the data to bring the bigger picture in view. In this paper, we are sharing our experience of botnet detection in the private network as well as in public zone by deploying the nepenthes honeypots. The automated framework for malware collection using nepenthes and analysis using anti-virus scan are discussed. The experimental results of botnet detection by enabling nepenthes honeypots in network are shown. Also we saw that existing known bots in our network can be detected.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
