Method and device for constructing covert channel based on ZeroNet

Abstract

The invention discloses a method for constructing a covert channel based on ZeroNet, and the method comprises the steps: judging whether a user host is a target controlled host or not when the condition that the user host accesses a target main control website is detected, and enabling the target main control website to be constructed according to a ZeroNet program; wherein a ZeroNet program is installed in the target controlled host; if the user host is a target controlled host, issuing a command to the target controlled host; enabling the target controlled host to receive the command and execute the command; and after the command is executed, receiving related information fed back by the target controlled host. In the above method, constructing a target master control website by adoptinga ZeroNet program; according to the method, the command is sent to the controlled host provided with the ZeroNet, a centralized channel is not needed, and a peer-list center node of a hard code doesnot need to be initialized and accessed, so that the problem that the channel becomes fragile due to a single-point failure defect and peer-list failure is avoided.

Description

technical field [0001] The invention relates to the technical field of information hiding, in particular to a method and device for constructing a covert channel based on ZeroNet. Background technique [0002] Command and Control (C&C for short) channel is a kind of covert channel, generally used for remote control, file transfer, etc. More and more studies have proved that command and control channel plays an important role in botnet and APT attacks . Studying the command and control channel can better prevent botnet and APT attacks, understand the command and control mechanism, efficiently monitor such attacks, detect and stop them in time, and reduce the harm of such attacks. [0003] The current mainstream command and control technologies include centralized structure and peer-to-peer P2P (peer to peer) structure. The centralized structure includes IRC protocol technology and HTTP protocol technology. In the IRC protocol technology, the controller can use the free pub...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present invention provides a method and device for constructing a covert channel based on ZeroNet, which is used to solve the single-point failure caused by the use of centralized channels in the prior art and the need to access hard-coded peers when initializing P2P covert channels -list central node, once the peer-list fails, the entire channel will become very fragile

Images