D-LNBot：比特币闪电网络上一种可扩展、零成本且隐蔽的混合僵尸网络
D-LNBot: A Scalable, Cost-Free and Covert Hybrid Botnet on Bitcoin's Lightning Network
AI总结：
本文提出基于比特币闪电网络的隐蔽混合僵尸网络LNBot及其分布式版本D-LNBot，利用LN的匿名特性实现控制者身份完全匿名化，支持零成本运行和快速命令传播，并在实际LN上验证了概念并分析了性能与对策。
摘要：
尽管过去曾提出过各种隐蔽的僵尸网络，但它们仍然缺乏对服务器/僵尸网络控制者的完全匿名化，或者僵尸网络控制者与僵尸程序之间的通信缓慢。在本文中，我们首先提出了一种新型混合僵尸网络，它通过比特币闪电网络（LN）进行隐蔽且高效的通信，称为LNBot。利用LN的各种匿名特性，我们展示了一种可扩展的两层僵尸网络的可行性，该网络完全匿名化了僵尸网络控制者的身份。在第一层，僵尸网络控制者通过常规的LN支付匿名地向命令与控制（C&C）服务器发送命令。具体而言，LNBot允许僵尸网络控制者的命令以隐蔽的多跳LN支付的形式发送，其中命令要么与支付一起编码，要么附加到支付上以提供隐蔽通信。在第二层，C&C服务器进一步将这些命令中继到其微型僵尸网络中的僵尸程序，以对受害机器发起任何类型的攻击。我们通过引入D-LNBot进一步改进了这一设计；这是LNBot的分布式版本，它通过感染互联网上的用户来生成其C&C服务器，并通过向LN上的现有节点开放通道来形成C&C连接。与LNBot相反，整个僵尸网络形成阶段是分布式的，僵尸网络控制者从不参与该过程。通过利用比特币的Testnet和LN的新消息附件功能，我们表明D-LNBot可以免费运行，并且与LNBot相比，命令能更快地传播到所有C&C服务器。我们在实际的LN上展示了LNBot和D-LNBot的概念验证实现，并广泛分析了它们的延迟和成本性能。最后，我们还提供并讨论了一系列潜在的对策，以检测LNBot和D-LNBot的活动并最小化其影响。
英文摘要：
While various covert botnets were proposed in the past, they still lack complete anonymization for their servers/botmasters or suffer from slow communication between the botmaster and the bots. In this paper, we first propose a new generation hybrid botnet that covertly and efficiently communicates over Bitcoin Lightning Network (LN), called LNBot. Exploiting various anonymity features of LN, we show the feasibility of a scalable two-layer botnet which completely anonymizes the identity of the botmaster. In the first layer, the botmaster anonymously sends the commands to the command and control (C&C) servers through regular LN payments. Specifically, LNBot allows botmaster's commands to be sent in the form of surreptitious multi-hop LN payments, where the commands are either encoded with the payments or attached to the payments to provide covert communications. In the second layer, C&C servers further relay those commands to the bots in their mini-botnets to launch any type of attacks to victim machines. We further improve on this design by introducing D-LNBot; a distributed version of LNBot that generates its C&C servers by infecting users on the Internet and forms the C&C connections by opening channels to the existing nodes on LN. In contrary to the LNBot, the whole botnet formation phase is distributed and the botmaster is never involved in the process. By utilizing Bitcoin's Testnet and the new message attachment feature of LN, we show that D-LNBot can be run for free and commands are propagated faster to all the C&C servers compared to LNBot. We presented proof-of-concept implementations for both LNBot and D-LNBot on the actual LN and extensively analyzed their delay and cost performance. Finally, we also provide and discuss a list of potential countermeasures to detect LNBot and D-LNBot activities and minimize their impacts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
