WO2010031288A1

WO2010031288A1 - Botnet inspection method and system

Info

Publication number: WO2010031288A1
Application number: PCT/CN2009/073338
Authority: WO
Inventors: 李安坤
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2008-09-18
Filing date: 2009-08-19
Publication date: 2010-03-25
Also published as: CN101360019A; CN101360019B

Abstract

A botnet inspection method and system are disclosed in the network communication security field. The method includes the following steps: receiving a communication message from the network to be tested; picking up botnet message information of the communication message according to the communication message; picking up bot host IP and controller IP according to the botnet message information; inquiring about the account numbers corresponding to the bot host IP and the controller IP according to the picked bot host IP and the controller IP. The system comprises the following parts: network probe, monitoring and analysis center, and authentication server. The botnet inspection method inspects the botnet in real time, and can also respond to the botnet in real time, thereby solves the problem in prior art about the unavailability of realtime detection and response caused by the ex post analysis, avoids the harm caused by the botnet, and makes the network communications more secure.

Description

Method and system for detecting botnet

This application claims priority to Chinese Patent Application No. 200810149039.4, entitled "Detection Method, System and Apparatus for a Botnet", filed on September 18, 2008, the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of network communication security, and in particular, to a method, system and device for detecting a botnet.

Background technique

A botnet (Botnet) uses one or more means of communication to infect a large number of hosts with a zombie Bot program (bott tool), thereby forming a one-to-many network between the controller and the infected host (ie, the zombie host). . As shown in Figure 1, the basic network structure of Botnet allows the attacker to control the zombie host through the controller.

The current botnet has two main network topologies:

See Figure 2, a multi-level tree botnet topology: consisting of victims, zombie hosts, controllers, and attackers. The specific workflow is: the controller opens the port; the zombie host initiates a connection to the controller's listening window, and notifies the controller; the controller actively connects to the upper controller's listening window, and the superior controller notifies itself; The zombie host sends an instruction, and the zombie host executes a control command to launch an attack. The behavioral characteristics of the botnet topology are: Multiple zombie hosts initiate connections to the same port of the same controller; zombie hosts typically communicate to the controller periodically.

See Figure 3, another botnet topology implemented by the IRC (Internet Relay Chat) protocol: consisting of victims, zombie hosts, IRC servers, and attackers. The specific workflow is as follows: the controller creates a communication channel on the IRC server; the zombie host automatically joins the communication channel created by the controller after logging in to the IRC server, waiting for the controller to initiate a command; the controller is on the communication channel specified on the IRC server. Send a command; the zombie host receives the command, executes the command, and launches the attack. The behavioral characteristics of the botnet topology: Zombie hosts are generally online for a long time; the zombie host as a IRC server chat user does not speak for a long time in the chat channel.

The botnet constitutes an attack platform, which can effectively launch a variety of attacks, resulting in the disclosure of the entire basic information network or important application systems, a large number of confidential or personal privacy, and is also used to engage in illegal activities such as online fraud. Common attacks that use Botnet to launch DDOS (Distributed Denial of Service), sending spam, stealing secrets, and abusing resources have caused serious harm to the entire network and users. With the emergence of various new types of attacks, Botnet may also be used to launch new unknown attacks.

The current technology to mitigate the threat of botnet attacks is mainly to prevent or deal with the after-effects of the attack. Usually, when the national cybersecurity monitoring department finds that a large site or an important network is attacked by a botnet, it starts to mobilize a large number of human resources and related departments to conduct an investigation. It takes a long time to truly find the ultimate controller of the botnet. That is, the attacker and the main involved, but the economic losses caused during this period are immeasurable.

There are currently two main methods for detecting botnets:

First, the honey technology: through the honeypot and other means to obtain the Bot program sample, using reverse engineering and other malicious code analysis means, to obtain the relevant information needed to log in to the Botnet hidden in the code, use a custom bot to log into the botnet , further adopt countermeasures.

Second, network traffic research: By studying the network traffic changes of zombie host behavior (such as the traffic volume in different time periods), using offline and online two analysis methods to achieve the judgment of the botnet.

After analyzing the existing technology, the inventor found that: Honey technology can not detect botnet communication messages in real time, nor can it quickly and accurately locate botnets and their operators; network traffic research can detect botnets in real time. The communication message does not respond to the botnet in real time.

Summary of the invention

In order to be able to detect a botnet in real time and respond to the botnet in real time, an embodiment of the present invention provides a method for detecting a botnet. The technical solution is as follows:

In one aspect, a method for detecting a botnet is provided, the method comprising:

Receiving a communication message of the network to be tested;

Extracting botnet message information of the communication packet according to the communication packet;

Extracting a zombie host IP and a controller IP according to the botnet message information;

And querying, according to the extracted zombie host IP and the controller IP, the account corresponding to the zombie host IP and the controller IP.

In one aspect, a detection system for a botnet is provided, the system comprising: a network probe, a monitoring and analysis center, and an authentication server;

The network probe is configured to receive a communication packet of the network to be tested, and according to the communication packet Obtaining botnet message information of the communication message;

The monitoring and analysis center is configured to extract a zombie host IP and a controller IP according to the botnet message information;

The authentication server is configured to query an account corresponding to the IP in the request according to the zombie host IP and the controller IP.

On the other hand, a monitoring and analysis system is provided, including a monitoring and analysis center and an authentication server, wherein

The authentication server is configured to extract a zombie host IP and a controller according to the monitoring and analysis center

IP, query the account corresponding to the zombie host IP and the controller IP.

The technical solution provided by the embodiment of the present invention has the beneficial effects that: the botnet detection method provided by the present invention detects the botnet in real time, and can also respond to the botnet in real time, which solves the problem in the prior art. The problem of post-analysis and real-time detection and real-time response avoids the harm caused by botnets and makes network communication more secure.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments or the description of the prior art will be briefly described below. Obviously, the following description will be attached. The drawings are only some of the embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor.

1 is a schematic diagram of a basic network architecture of a botnet provided by the prior art;

2 is a schematic diagram of a tree bot network topology structure of a multi-level control provided by the prior art; FIG. 3 is a schematic diagram of a botnet topology structure based on the IRC protocol provided by the prior art; FIG. 4 is a botnet detection method provided by the present invention. Schematic diagram of system architecture;

5 is a schematic flowchart of a method for detecting a botnet according to Embodiment 1 of the present invention; FIG. 6 is a schematic flowchart of a method for detecting a botnet according to Embodiment 2 of the present invention; FIG. 8 is a schematic diagram of a detection system of a botnet according to Embodiment 4 of the present invention; FIG.

9 is a schematic diagram of a detection system of a botnet according to Embodiment 4 of the present invention; FIG. 10 is another specific schematic diagram of a detection system of a botnet according to Embodiment 4 of the present invention; FIG.

11 is a schematic diagram of a monitoring and analysis center according to Embodiment 5 of the present invention;

FIG. 12 is another schematic diagram of a monitoring and analysis center according to Embodiment 5 of the present invention.

detailed description

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the invention, rather than all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The botnet is multi-level controlled. To track the attacker behind the scenes, first track the controller that sends the command to the zombie host, and then monitor the controller to find the upper-level controller, and trace the level one level until the real Attacker. The Botnet Inspection System (BIS) according to the embodiment of the present invention can detect a zombie host and its controller of a known or unknown botnet in real time, grasp the information of the botnet and implement monitoring, and can also perform real-time monitoring. Take action on the botnet.

Referring to FIG. 4, a schematic diagram of a botnet detection system architecture is provided by an embodiment of the present invention. The botnet detection system includes: a network probe 401, a device management center 402, a monitoring and analysis center 403, a database DB 404, a WEB 405, and other security devices 406. The network probe 401 detects real-time network traffic and reports the detection result to the bot. The monitoring and analysis center 403; the device management center 402 manages devices such as the network probe 401, the monitoring and analysis center 403, the database DB 404, the WEB 405, and other security devices 406, provides reliable connection with the firewall, and interacts with the service data between the devices; The analysis center 403 performs a summary analysis on the detection results of the network probe 401, stores the detection result of the network probe 401 and the analysis result of the monitoring analysis center 403 in the database DB 404, and is responsible for other security devices 406 such as a firewall and other botnets. The detection system communicates; the database DB404 saves the interface policy, the configuration item, the botnet information and the auxiliary detection result; WEB405, provides the botnet detection configuration interface, the botnet information display interface, the device management interface; the other security device 406, and the botnet Testing system Linkage, the detected bots attack or IP address to the monitoring and analysis center 403, such as firewalls, other botnet detection system. In order to elaborate the botnet detection system provided by the embodiment of the present invention, refer to the following embodiments. Example 1

The embodiment of the invention provides a method for detecting a botnet, which identifies a botnet message by matching a communication message with a rule stored in a rule base, thereby implementing detection of a botnet network.

The botnet detection system has formed a rule repository stored in the database before it is detected. The steps of the rule base formation process are as follows:

Step A: The botnet detection system analyzes the communication message of the zombie host and the controller in the existing botnet, and extracts the zombie message feature from the communication message to form a feature database; wherein, the communication message The extracted zombie message features are specifically bot name, protocol type, botnet type, and the like.

Step B: Convert the signature database into a rule base that can be recognized by the computer, and encrypt the converted rule base and store it in the database DB.

The feature rules of botnet packets in the rule base are described as follows:

[-PROTO Protocol -SRVID SrvType -APPID id -APPNAME AppType -RET RetValue \ -ACTION ActionType -RELATE RelateType

-RULEID ruleid]

Among them, PROTO: protocol type, such as tcp/udp/icmp;

SRVID: Service type, such as 5-voip, 6-p2p, 97-ftp, etc.

APPID: botnet type, such as 1 for tree botnet, 2 for IRC botnet, 3 for p2p botnet;

APPNAME: App name, corresponding to the bot name;

RET: Return value, corresponding to the packet direction of the returned packet, such as 1-zombie host to controller message, 2-controller to zombie host message;

ACTION: Matching mode, such as single packet matching, multi-packet matching, port matching, etc.;

RELATE: association, whether multiple features are associated;

RULEID: The rule number, which is the first few rules. According to the above description of the feature rules of the botnet message, an example is illustrated. For example, an upstream zombie, the zombie host actively sends a message length of 6 bytes to the control terminal every 30 seconds: 4D 54 49 7A 0D OA TCP message, the rules are as follows:

-PROTO TCP -SRVID 16 -APPID 1 -APPNAME shangxing -RET 1 \

-ACTION SINGLE-PKT -RELATE NO \

-KEY

0: LOAD_BEGIN: BIG_ENDIAN: 6: EQUAL: BIN: 4D54497A0D0A \

-LOADLEN

0: LOAD_BEGIN: BIG_ENDIAN: 0: EQUAL: BIN: 0006

The above describes in detail the formation process of the feature library stored in the database. The rule base is a precondition for the botnet detection system to perform feature detection on the botnet. The following describes the method for detecting the botnet by the botnet detection system after forming the rule base. Referring to Figure 5, the specific steps are as follows:

Step 501: The network probe of the botnet detection system receives the communication packet of the network to be tested.

Step 502: The network probe performs the rule matching the received communication message with the rule obtained from the rule base. If the matching is successful, step 503 is performed; otherwise, the process ends;

The specific process of the network probe acquiring the rule from the rule base is: When the botnet detection system starts, the network probe automatically requests the rule from the routing device SRS (Service Route System), and the SRS reads the rule in the database DB, and It is transmitted to the network probe, and the network probe puts the acquired rules into its own memory. When receiving the communication message, the network probe will receive the received communication message and the obtained rule in its own memory. Match; if the rule base has an update, the network probe will re-acquire the rules from the database DB;

The above rule matching can have multiple matching methods, such as single packet matching, multi-packet matching, port matching, and the like;

Wherein, the single packet matching is a matching rule according to the characteristics of a message;

Multi-packet matching is to match a rule according to the characteristics of multiple messages;

Port matching is based on the port information matching rule in the packet.

If the matching of the above rules is successful, all the parameters of a rule (such as protocol type, service type, botnet type, application name, matching mode, etc., different parameters carry different parameters) are consistent. Step 503: After the communication packet rules of the network to be tested are successfully matched, the network probe extracts the botnet packet information in the communication packet, and sends the information to the monitoring and analysis center of the botnet detection system. The step is specifically : The network probe returns the corresponding values in the matching matching rules according to the matching rules, such as PROTO, SRVID, APPID, AppType, RET and data flow direction. The information is the botnet message information, and the network probe puts the information. The information is encapsulated into a message packet and sent to the monitoring and analysis center.

Step 504: After receiving the botnet message information sent by the network probe, the monitoring and analysis center parses the botnet information from the information, caches the parsed botnet information, and sends a query to the Radius server. The account request of the zombie host IP and the controller IP; the query IP account request carries the checked zombie host IP and the controller IP address;

The specific analysis of botnet information from botnet message information is:

The monitoring and analysis center returns the value RET according to the rules in the botnet message information ( RET: return value, corresponding to the packet direction of the returned packet, such as 1-zombie host to controller message, 2-controller to zombie host message ) and the direction of the data stream transmission (determining the direction in which the data stream flows in and out) determines whether the local IP and the remote IP are zombie hosts or controllers, thereby obtaining the zombie host IP, the zombie host IP port, the controller IP, and the control. Information such as the IP port; for example, in the botnet message information formed after the communication packet between A and B is successfully matched, if the data flow direction is from A to B, the RET value is 1 (1-zombie host to The controller message), it can be determined that A is a zombie host, and B is a controller;

The type of bot is directly derived from the APPID in the botnet message information, such as 1 for a tree botnet, 2 for an IRC botnet, and 3 for a p2p botnet;

The name of the bot is directly derived from the APPNAME in the botnet message information. Direct storage does not require analysis; the botnet time is updated and the botnet time control analysis center directly obtains its own machine time;

The way the botnet is discovered is carried in the botnet.

The above botnet information is specifically: zombie host ΙΡ, zombie host IP port, controller IP, controller IP port, IRC server IP, IRC server port, bots, bot time discovery, botnet time update, zombie discovery Network mode

The above botnet information can be specifically cached in the memory of the monitoring and analysis center, waiting for the query to be stiff. The IP account process of the corpse and the controller.

Step 505: After receiving the query request, the Radius server queries the Radius server for the account corresponding to the IP in the request, and sends the found IP account to the monitoring and analysis center, and the monitoring and analysis center caches the botnet information and the queried information. The IP account is stored in the database together;

The Radius server is an authentication server. For example, when dial-up users access the Internet, they need to go to the Radius server to authenticate their account, password, permissions, and balance. In the networking, the Radius server knows the account name of the current user's IP beforehand, so it Query the IP account number, so that the dynamic IP address of 4 bar can be reduced to 4;

The monitoring and analysis center and the Radius server have interfaces. The interface has an interface function. The specific steps for querying the account corresponding to the IP in the Radius server are as follows: After receiving the above query request from the monitoring and analysis center, the Radius server passes the interface. The function extracts the IP in the request, and queries the Radius server for the account corresponding to the IP, and then sends the IP and its corresponding account back to the monitoring and analysis center through the interface function.

In addition, the entire system can have a dedicated database server, and the databases mentioned in the above steps can be set on these servers.

In the embodiment of the present invention, the feature detection of the botnet is performed according to the content of the message, and the botnet is detected in real time, and the botnet can also respond in real time, which solves the problem in the prior art that cannot be detected in real time based on post-mortem analysis. And real-time response problems, avoiding the harm caused by botnets, making network communication more secure. Example 2

If the botnet communication message is featureless or the cryptographic feature disappears, or is a new botnet tool, the embodiment of the present invention provides a botnet detection method for the above situation. The method identifies the zombie host and controller according to the network behavior between the zombie host and the controller and the normal user, and saves the botnet communication message between them. The message feature is manually extracted, and the message feature library in Embodiment 1 is improved. See Figure 6, the specific steps are as follows:

Step 601: The monitoring and analysis center of the botnet detection system receives the list of IP addresses to be detected, and sends the IP address list to the network probe. The foregoing list of IP addresses to be detected is specifically a list of IP addresses generated by a botnet detection system detected by a firewall or other distributed deployment, or any suspected IP address list;

Since the IP address of the attack is not necessarily a zombie host, it is necessary to specifically detect the IP address of the attack to confirm the zombie host and controller.

Step 602: The network probe receives the IP address list, and monitors the IP address in the IP address list, and extracts botnet message information from the source address or the destination address for the communication message of the IP address, and sends the information to the botnet message. Monitoring and analysis center;

The network probe has a data flow table, and extracts botnet message information from related information of the data stream;

The botnet information refers to the zombie host IP, the port, the communication peer IP, the peer port, the packet protocol type, the packet direction, the number of packets, and the number of packets.

Step 603: The monitoring and analysis center receives the botnet message information sent by the network probe, performs botnet behavior statistical analysis on the information, determines the zombie host IP and the controller IP according to the statistical result, and caches the botnet message information. Up, send a request to the Radius server to query the zombie host and the controller's IP account request; wherein, the statistical analysis of the botnet "3⁄4 text information" is: multiple zombie hosts initiate connections to the same port of the same controller; zombie host will Timing communicates with the controller at the same time; the controller sends the same command to multiple zombie hosts at the same time; the zombie host is online for a long time but silent and does not speak, etc.; for the same port multi-connection, this behavior feature can count the connection within a certain period of time The number of IP attack IPs. If the threshold is exceeded, the connected IP is the controller IP. These attack IPs are the IPs of the zombie hosts, so that the botnet behavior and controller can be determined. That is: According to the zombie host and controller Network behavior is different from normal user's network behavior, thus Wherein other bots and the controller;

The IP account request carries the IP address of the queried host and controller.

Step 604: After receiving the query request, the Radius server queries the Radius server for the account corresponding to the IP in the request, and sends the found IP account to the monitoring and analysis center, and the monitoring and analysis center caches the botnet message information and the query. The IP account is stored in the database together; the monitoring and analysis center and the Radius server have interfaces, and the interface has an interface function;

The specific step of querying the account corresponding to the IP in the request in the Radius server is: After receiving the above query request sent by the monitoring and analysis center, the Radius server extracts the request through the interface function. IP, and query the account corresponding to the IP on the Radius server, and then send the IP and its corresponding account back to the monitoring and analysis center through the interface function.

In addition, a dedicated database server can be set up, and the databases mentioned in the above steps are set on these database servers.

In addition, after the botnet message information is stored in the database server, the new message feature is extracted by manual analysis, and the extracted new message feature is converted into a new rule and stored in the rule base. Make the rule base more complete.

The embodiment of the invention detects the behavior of the botnet, detects the botnet in real time, and can respond to the botnet in real time, and solves the problem that the real-time detection and real-time response cannot be detected based on the post-mortem analysis in the prior art. And save the botnet communication message between the controller and the zombie host for subsequent manual extraction of the message feature, improve the message feature database, avoid the harm caused by the botnet, and make the network communication more secure. Example 3

In order to better grasp the information of the botnet, the embodiment of the present invention further provides two auxiliary means: active detection and remote packet capture for confirming botnet information; wherein the two auxiliary means are manual and automatic Means; specific implementation steps for detecting botnets using these two methods are specifically described below.

(1) See Figure 7. The specific steps for active detection are as follows:

Step 701: The botnet detection system simulates that the zombie host sends a botnet communication message to the IP suspected of being the controller.

The botnet communication packet provided by the botnet detection system is a probe packet, and has a detection option that the content is blocked. In some cases, the user is allowed to construct a probe packet by itself, so that the user has greater freedom;

The specific behavioral characteristics of the suspected controller are: timed communication, multi-link on the same port, long-term online, long-term non-speaking and other behavioral characteristics.

Step 702: Detecting whether there is a response to the sent botnet communication message botnet detection system, if yes, executing step 703; otherwise, ending.

Step 703: If there is a response to the sent botnet communication message, the content of the response is performed. Feature detection or behavior detection, determining whether it is a response message of the suspect controller, if yes, executing step 704; otherwise, ending.

Step 704: If the content of the detected response is a response message of the suspect controller, it is determined that the host is a controller.

(2) Specific steps for remote packet capture: When detecting the communication packet of an IP address, save the communication packet whose destination address or source address is the IP address for analysis; the botnet detection system provides support for quintuple filtering. Conditional packet capture, namely: source IP, destination IP, source port, destination port, and protocol.

The embodiment of the present invention detects the botnet in real time by actively detecting and remotely capturing the botnet, and can also respond to the botnet in real time, and solves the problem in the prior art that cannot be detected in real time based on post-mortem analysis. Responsive problems, better grasp the information of the botnet, provide auxiliary means for the botnet detection system, and these two auxiliary means are artificial and automatic, more flexible, making the botnet detection system more complete and powerful. , to the greatest extent avoid the harm caused by botnets, making network communication more secure. Example 4

Referring to FIG. 8, an embodiment of the present invention provides a detection system for a botnet, and the system includes: a network probe 801, a monitoring and analysis center 802, and an authentication server 803;

The network probe 801 is configured to receive a communication packet of the network to be tested, and extract botnet packet information of the communication packet according to the communication packet;

Monitoring and Analysis Center 802, which is used to extract zombie host IP and controller based on botnet message information

IP;

The authentication server 803 is configured to query the account corresponding to the zombie host IP and the controller IP according to the extracted zombie host IP and the controller IP.

(1) wherein, when performing feature detection, referring to FIG. 9, the network probe 801 includes: a receiving module 8011, a matching module 8012, and an extracting module 8013;

The receiving module 8011 is configured to receive a communication packet of the network to be tested.

The matching module 8012 is configured to match the communication packet of the network to be tested received by the receiving module 8011 with the rule obtained in the rule base;

The extraction module 8013 is configured to: if the matching module 8012 matches successfully, the communication packet is a botnet. The packet is sent to extract botnet message information in the botnet message; the botnet message information includes PROTO, SRVID, APPID, AppType, rule return value RET, and data flow direction, etc., and the monitoring and analysis center 802 includes : judging module 8021;

The determining module 8021 is configured to determine, according to the rule return value RET and the data transmission direction of the botnet message information extracted from the prompting block 8013, whether the local IP and the remote IP are zombie hosts or controllers, thereby determining the zombie host. IP and controller IP.

(2) wherein, when performing behavior detection, referring to FIG. 10, the network probe 801 includes: a receiving module 8014 and an extracting module 8015,

The receiving module 8014 is configured to receive a list of IP addresses to be detected, and monitor an IP address in the IP address list to obtain a communication packet whose source address or destination address is an IP address.

The extraction module 8015 is configured to determine that the communication message is a botnet message, and the information of the communication message is botnet message information.

Correspondingly, the monitoring and analysis center 802 includes: a statistics module 8022 and a determining module 8023;

The statistic module 8022 is configured to perform botnet behavior statistic determination module 8023 for the botnet message information, and configured to determine a zombie host IP and a controller IP according to the statistics result of the statistic module.

Further, the monitoring and analysis center further includes an analysis module 8024;

The analysis module 8024 is configured to analyze the botnet message information, extract new message features, and convert the extracted new message features into new rules, and store them in the rule base.

(3) In the case of remote packet capture, the monitoring and analysis center 802 further includes an acquiring module, and the acquiring module is configured to acquire the network to be tested by remote packet capture according to the source IP address, the destination IP address, the source port, the destination port, and the packet protocol. Corresponding communication message.

Alternatively, when the remote packet capture is adopted, the obtained module may also be disposed in the network probe 801. The embodiment of the invention provides a detection system for a botnet, which detects a botnet in real time, and can also respond to the botnet in real time, and solves the problem that the prior art cannot detect and respond in real time based on post-mortem analysis. The problem is to avoid the harm caused by the botnet, making the network communication more secure. Example 5

The embodiment of the present invention provides a monitoring and analysis center. The monitoring and analysis center is configured to extract the zombie host IP and the controller IP according to the botnet message information, and query the account corresponding to the IP according to the zombie host IP and the controller IP.

(1) wherein, when performing feature detection, referring to FIG. 11, the monitoring and analysis center includes: a judgment module 1101;

The judging module 1101 is configured to determine whether the local IP and the remote IP are zombie hosts or controllers from the rule return value in the botnet message information and the transmission direction of the data stream, thereby determining the zombie host IP and the controller IP.

(2) wherein, when performing behavior detection, referring to FIG. 12, the monitoring analysis center includes: a statistical module 1202 and a determining module 1203;

The statistic module 1202 is configured to perform a botnet behavior statistic determination module 1203 for the botnet message information, and configured to determine a zombie host according to the statistical result of the statistic module 1202.

IP and controller IP.

Further, the monitoring and analysis center specifically includes an analysis module 1204;

The analysis module 1204 is configured to analyze the botnet message information, extract new message features, and convert the extracted new message features into new rules, and store them in the rule base.

(3) In the case of remote packet capture, the monitoring and analysis center further includes an acquisition module, and an acquisition module is configured to acquire the packet by remote packet capture according to the source IP address, the destination IP address, the source port, the destination port, and the packet protocol. Measure the corresponding communication message in the network.

The embodiment of the present invention provides a monitoring and analysis center, which detects a botnet in real time, and can also respond to the botnet in real time, and solves the problem that the prior art cannot detect and respond in real time based on post-mortem analysis. It avoids the harm caused by botnets and makes network communication more secure.

In summary, the embodiment of the present invention provides a botnet detection method for analyzing packet characteristics of the introduced network traffic, identifying a zombie host and its controller in the botnet, recording botnet information, and issuing an alarm; The detection system of the botnet provided by the invention can also be linked with the network security devices such as other detection systems and firewalls distributed, and obtain the IP address of the attack source. Control, analyze the network behavior of the network traffic, and find out the controllers that control them. In addition, the botnet detection method provided by the present invention also provides an auxiliary detection means such as active detection and remote packet capture, and information about the botnet. Confirm to ensure the accuracy of the system identification. A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium, the program When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

Rights request

A method for detecting a botnet, the method comprising:

Receiving a communication message of the network to be tested;

2. The method of claim 1, wherein the botnet message information for extracting the communication message according to the communication message comprises:

Matching the communication packet with a rule obtained in the rule base;

If the matching is successful, the communication message is a botnet message, and the botnet message information in the botnet message is extracted.

The method according to claim 2, wherein the extracting the zombie host IP and the controller IP according to the botnet message information comprises:

The difference between the rule return value and the data stream transmission direction in the botnet message information determines whether the local IP and the remote IP are zombie hosts or controllers.

The method of claim 1, wherein the receiving the communication message of the network to be tested comprises:

Receiving a list of IP addresses to be detected;

The IP address in the IP address list is monitored to obtain a communication packet whose source address or destination address is the IP address.

5. The method of claim 4, wherein

The communication message is a botnet message, and the information of the communication message is a botnet message. Correspondingly, the extracting the zombie host IP and the controller IP according to the botnet message information includes:

The botnet behavior statistical analysis is performed on the botnet message information, and the zombie host IP and the controller IP are determined according to the statistical result.

The method of claim 5, wherein the method further comprises: The botnet message information is analyzed, new message features are extracted, and the extracted new message features are converted into new rules and stored in the rule base.

The method according to claim 1, wherein the receiving the communication message of the network to be tested comprises:

According to the source IP address, the destination IP address, the source port, the destination port, and the packet protocol, the corresponding communication in the network to be tested is obtained through remote packet capture.

8. A detection system for a botnet, the system comprising: a network probe, a monitoring and analysis center, and an authentication server;

The network probe is configured to receive a communication packet of the network to be tested, and extract botnet packet information of the communication packet according to the communication packet;

The authentication server is configured to query an account corresponding to the zombie host IP and the controller IP according to the zombie host IP and the controller IP extracted by the monitoring and analysis center.

9. The system of claim 8, wherein the network probe comprises: a receiving module, a matching module, and an extracting module;

The receiving module is configured to receive a communication packet of the network to be tested;

The matching module is configured to perform a rule matching on a communication packet of the network to be tested received by the receiving module and a rule obtained in a rule base;

The extracting module is configured to: if the matching module is successfully matched, the communication packet is a botnet packet, and extract botnet packet information in the botnet packet.

10. The system of claim 9, wherein the monitoring and analysis center comprises: a determination module;

The determining module is configured to determine, according to a difference between a rule return value and a data flow direction of the botnet message information, whether the local IP and the remote IP are a zombie host or a controller, thereby determining a zombie host IP and a controller. IP.

The system according to claim 8, wherein the network probe comprises: a receiving module and an extracting module;

The receiving module is configured to receive a list of IP addresses to be detected, and in the list of IP addresses The IP address is monitored to obtain a communication packet whose source address or destination address is the IP address. The extraction module is configured to determine that the communication packet is a botnet packet, and the information of the communication packet is a botnet. "3⁄4 text information.

12. The system of claim 11, wherein the monitoring and analysis center comprises: a statistics module and a determining module;

The statistic module is configured to perform botnet behavior statistics on the botnet message information, and the determining module is configured to determine a zombie host IP and a controller IP according to the statistics result of the statistic module.

13. The system of claim 12, wherein the monitoring and analysis center further comprises an analysis module;

The analyzing module is configured to analyze the botnet message information, extract new packet features, and convert the extracted new message features into new rules, and store them in the rule base.

14. The system of claim 8, wherein the monitoring and analysis center further comprises an acquisition block;

The obtaining module is configured to obtain a corresponding communication packet in the network to be tested by remotely capturing packets according to the source IP address, the destination IP address, the source port, the destination port, and the packet protocol.

The system according to claim 8, wherein the network probe further comprises an ear block;

The obtaining module is configured to obtain, according to the source IP, the destination IP, the source port, the destination port, and the remote protocol packet, the corresponding communication packet in the network to be tested.

16. A monitoring and analysis system, comprising: a monitoring and analysis center and an authentication server, wherein

The monitoring and analysis system according to claim 16, wherein the monitoring and analysis center comprises: a determining module; The determining module is configured to determine, according to a difference between a rule return value and a data flow direction of the botnet message information, whether the local IP and the remote IP are a zombie host or a controller, thereby determining a zombie host IP and a controller. IP.

The monitoring and analysis system according to claim 16, wherein the monitoring and analysis center comprises: a statistics module and a determining module;

The monitoring and analysis system according to claim 18, wherein the monitoring and analysis center further comprises an analysis module;

The monitoring and analysis system according to claim 16, wherein the monitoring and analysis center further comprises an acquiring module;

The acquiring module is configured to obtain a corresponding communication packet in the network to be tested by remote packet capture according to the source IP address, the destination IP address, the source port, the destination port, and the packet protocol.