arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2009.07707cs.CRcs.AI
收藏

DeepC2：人工智能驱动的OSN隐蔽命令和控制

DeepC2: AI-powered Covert Command and Control on OSNs

Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Cyberspace Institute of Advanced Technology, Guangzhou University（广州大学网络空间先进技术研究院）

Zhi Wang, Chaoge Liu, Xiang Cui, Jie Yin, Jiaxi Liu, Di Wu, Qixu Liu

备注：
A later version of this paper is accepted at the 24th International Conference on Information and Communications Security (ICICS 2022)
发表信息：
24th International Conference on Information and Communications Security (ICICS 2022)
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

摘要：

指挥和控制（C&C）在攻击中非常重要。它将攻击者的命令传输给受感染主机中的恶意软件。目前，一些攻击者在C&C任务中使用在线社交网络（OSN）。OSN上的C&C存在两个主要问题。首先，恶意软件找到攻击者的过程是可逆的。如果防御者分析了恶意软件样本，攻击者将在发布命令之前暴露。第二，明文或加密形式的命令被OSN视为异常内容，这将引起异常并触发对攻击者的限制。防御者一旦暴露就可以限制攻击者。在这项工作中，我们提出了DeepC2，一个基于人工智能的C&C on OSN，来解决这些问题。对于可逆硬编码，恶意软件使用神经网络模型找到攻击者。攻击者的化身被转换成一批特征向量，防御者无法使用模型和特征向量预先恢复化身。为了解决OSN上的异常内容，使用哈希冲突和文本数据增强将命令嵌入到正常内容中。在Twitter上的实验表明，嵌入命令的推文可以有效地生成。恶意软件可以在OSN上隐蔽地找到攻击者。安全分析表明，很难提前恢复攻击者的标识符。

英文摘要：

Command and control (C&C) is important in an attack. It transfers commands from the attacker to the malware in the compromised hosts. Currently, some attackers use online social networks (OSNs) in C&C tasks. There are two main problems in the C&C on OSNs. First, the process for the malware to find the attacker is reversible. If the malware sample is analyzed by the defender, the attacker would be exposed before publishing the commands. Second, the commands in plain or encrypted form are regarded as abnormal contents by OSNs, which would raise anomalies and trigger restrictions on the attacker. The defender can limit the attacker once it is exposed. In this work, we propose DeepC2, an AI-powered C&C on OSNs, to solve these problems. For the reversible hard-coding, the malware finds the attacker using a neural network model. The attacker's avatars are converted into a batch of feature vectors, and the defender cannot recover the avatars in advance using the model and the feature vectors. To solve the abnormal contents on OSNs, hash collision and text data augmentation are used to embed commands into normal contents. The experiment on Twitter shows that command-embedded tweets can be generated efficiently. The malware can find the attacker covertly on OSNs. Security analysis shows it is hard to recover the attacker's identifiers in advance.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑