Method for analyzing network flow to measure botnet control scale

Abstract

The invention relates to a method for measuring a botnet control scale by analyzing network traffic, which comprises the following steps of: firstly, collecting discovered botnet program samples, and establishing a botnet command and control instruction characteristic data set; the method comprises the following steps: analyzing network inflow and outflow flows, identifying and recording session information conforming to instruction characteristics, and recording botnet commands and control logs; associating the command and control log with a domain name request log in network traffic in real time, and adding a C2 control domain name field in the command and control log; and finally, analyzing the command and the control log by using a botnet control scale measurement algorithm, calculating the accumulated communication broiler IP number of each family, each C2 control domain name and each C2IP address of the botnet and the daily communication broiler IP number, and sensing and discovering the botnet with the large control scale or the rapidly expanded control scale. According to the method, the broiler traffic is accurately identified from the network traffic accessing the C2 so as to calculate the botnet scale, the coverage range is more comprehensive, and the measurement method is accurate.

Description

Technical Field

[0001] The present invention relates to a method for measuring the scale of a botnet in the technical field of network security, and in particular to a method for measuring the control scale of a botnet by analyzing network traffic. Background Art

[0002] Botnet refers to a network that uses one or more means of propagation to infect a large number of networked devices with zombie programs, thus forming a one-to-many controllable network between attackers and infected devices. Botnets are composed of botnet masters (i.e. attackers), command and control servers (C2), and zombie hosts (i.e. zombies). The botnet master issues instructions to zombies through C2. Currently discovered botnets can be mainly divided into centralized botnets and P2P botnets according to network topology. In P2P botnets, each zombie is both a C2 and a zombie. Botnets can constitute attack platforms, and attackers can use this platform to launch various attacks.

[0003] With the deepening of networking and informatization, a large number of networked devices on the Internet that lack network security protection have provided attackers with massive attack resources. Large-scale botnets continue to emerge, seriously affecting the normal operation of basic networks and important information systems. For example, the Mirai botnet discovered in 2016 controlled a large number of IoT devices around the world and used these devices as nodes to launch large-scale DDoS attacks, which caused mainstream networks such as Dyn, OVH, Github, and Twitter to be unable to provide services normally; the Fodcha botnet discovered in 2022 can control devices of various architectures and has attacked our important information systems many times. It is very necessary to detect and discover large-scale botnets in a timely manner and take various measures to govern them in order to maintain the network security of basic networks and important information systems.

[0004] At present, the research focus of security agencies and related units is to quickly discover new botnets based on terminal data, honeypot capture data, etc., but there is a lack of accurate and efficient measurement methods for the control scale of botnets. The control scale is mainly estimated by using the botnet C2IP address or domain name access volume or the terminal and honeypot infection ratio. Due to the large amount of network scanning detection data and the limited number of terminal honeypot deployments, the existing methods cannot accurately measure the control scale of botnets in a specific network.

[0005] There is no unified and accurate method for measuring the scale of botnets. There are two main methods in the industry. Method 1 is to statistically analyze the visits to the botnet C2IP address or domain name, and calculate the control scale based on the number of visited IPs, but this method is inaccurate. First, there is a lot of scanning and detection traffic on the network. These traffics visit the C2IP address or domain name, which does not mean that it is controlled; second, other services are running on the C2IP, and the traffic of the IP or domain name is not necessarily the traffic of zombie chickens; this leads to inaccurate calculations by this method. Method 2 is to estimate the control scale based on the number of deployed detection terminals and honeypots, as well as the infection ratio of terminals and honeypots. Because the number of deployed terminal honeypots is limited, the estimate is also inaccurate.

[0006] In view of the above-mentioned defects in the existing technology, the inventor has finally created the present invention which is of practical value after continuous research, design, repeated trials and improvements. Summary of the invention

[0007] The main purpose of the present invention is to overcome the defects of the prior art and provide a method for analyzing network traffic to measure the control scale of a botnet. The technical problem to be solved is to quickly, efficiently and accurately measure the control scales of various botnets in a specific network. The monitoring coverage is more comprehensive, and the measurement and analysis are more accurate and efficient. It can be used to support the timely discovery of large-scale botnets and rapidly and massively expanding botnets, so as to facilitate subsequent special governance, and is very suitable for practical use.

[0008] The idea of ​​the present invention is to accurately identify the traffic of zombies from the network traffic accessing C2 and then calculate the scale of the botnet, and the measurement method is accurate. To this end, the present invention first establishes a botnet command and control instruction feature data set; captures and restores the botnet command and control instruction data by analyzing the network traffic, and records and analyzes the botnet command and control log; finally, it continuously monitors the communication zombie activities from multiple dimensions such as each family of the botnet, each C2 control domain name, and each C2IP address in real time, and accurately measures and tracks the control scale of each family, each C2 control domain name, and each C2IP address.

[0009] The purpose of the present invention and the technical problem to be solved are achieved by adopting the following technical solutions. A method for analyzing network traffic and measuring the control scale of a botnet proposed in the present invention comprises the following steps:

[0010] Step 1: Collect the exposed and discovered bot samples, extract the network session features of botnet command and control instructions through sample code reverse analysis or communication data analysis, and establish a botnet command and control instruction feature dataset;

[0011] Step 2: Obtain the network inflow and outflow traffic according to the detection coverage, conduct in-depth analysis of the network inflow and outflow traffic through deep packet data inspection technology, and deeply read the content information of the IP message payload to reassemble and obtain complete session information;

[0012] Step 3: Match and compare each session information with the botnet command and control instruction feature data set, identify and record the session information that meets the instruction features, and record the botnet command and control log. The command and control log includes communication time, instruction type, botnet IP, botnet communication port, C2IP, C2 port, botnet family, and communication session data;

[0013] Step 4: Correlate the command and control logs with the domain name request logs in the network traffic in real time, analyze the domain name requests before and during the access period of the zombies to C2IP, obtain the domain name with the resolution value of C2IP, that is, the C2 control domain name, and add the C2 control domain name field to the command and control logs;

[0014] Step 5: Use the botnet control scale measurement algorithm to analyze the command and control logs, and calculate the cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs for each botnet family, each C2 control domain name, and each C2IP address.

[0015] The purpose of the present invention and the solution to its technical problems can be further achieved by adopting the following technical measures.

[0016] In the above technical scheme, the cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs of each family, each C2 controlled domain name, and each C2IP address of the botnet are all used to indicate the control scale and changing trend of the botnet. Botnets with large control scale or rapidly expanding control scale can be perceived and discovered by setting thresholds.

[0017] In the above scheme, the step 4 specifically includes the following steps:

[0018] Step 4.1: Set the time threshold Ns, and obtain the bot domain name access request log from the communication time between the bot and C2IP - Ns to the communication time between the bot and C2IP;

[0019] Step 4.2: Analyze the domain name request log obtained in step 4.1 to obtain the domain name whose resolution value is C2IP, i.e., the C2 controlled domain name;

[0020] Step 4.3: Set the time threshold Nt, and add the C2 control domain name field to the logs of the same C2IP in the botnet command and control logs within the time period from the communication time between the botnet and C2IP - Nt to the communication time between the botnet and C2IP + Nt. The control domain name value is the C2 control domain name analyzed in step 4.2.

[0021] In the above technical solution, the botnet command and control instructions are online instructions, heartbeat instructions, data return instructions that the bots send to C2 on a regular basis, or attack instructions and operation instructions that C2 sends to bots on a regular basis.

[0022] In the above technical solution, the cumulative number of communicating botnet IPs, the daily number of communicating botnet IPs and the hourly number of communicating botnet IPs refer to the number of botnet IPs after deduplication in the command and control log within a specific time range, that is, the number of different botnet IPs, which are used to represent the scale of the botnet within a specific time range.

[0023] In the above technical solution, the network is each operator network, each subordinate operator network and each large enterprise internal network.

[0024] By means of the above technical solution, it has at least the following advantages:

[0025] 1. The present invention captures and analyzes the botnet command and control logs. The log data is accurate and does not retain scanning detection data. It is independent of the number of terminals and honeypots deployed. It can fully grasp the activity of each botnet in a specific network. Compared with traditional monitoring methods, the coverage is more comprehensive and the measurement and analysis is more timely and accurate.

[0026] 2. The present invention selects detection at the command and control stage of the botnet, which can achieve twice the result with half the effort.

[0027] 3. The present invention can measure the control scale of all botnets that have been exposed and discovered, and can timely discover botnets with large control scales or rapidly expanding control scales, thereby improving the effectiveness of botnet governance.

[0028] The specific method of the present invention is given in detail by the following examples and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a framework diagram of the process of the present invention. DETAILED DESCRIPTION

[0030] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following is a detailed description of the method for analyzing network traffic and measuring the control scale of a botnet proposed by the present invention, its specific implementation method, method, steps, features and effects, in combination with the accompanying drawings and preferred embodiments.

[0031] See also Figure 1 A method for analyzing network traffic and measuring the control scale of a botnet according to a preferred embodiment of the present invention mainly comprises the following steps:

[0032] Step S1: Collect the exposed and discovered bot samples, extract the network session features of botnet command and control instructions through sample code reverse analysis or communication data analysis, and establish a botnet command and control instruction feature data set;

[0033] As an embodiment, the botnet command and control instruction in step S1 is an online instruction, a heartbeat instruction, a data return instruction that the bot regularly sends to C2, or an attack instruction or an operation instruction that C2 regularly sends to the bot.

[0034] Step S2: Obtain the network inflow and outflow traffic according to the detection coverage, perform in-depth analysis on the network inflow and outflow traffic through deep packet data detection technology, and deeply read the content information carried by the IP message to reassemble and obtain complete session information;

[0035] As an embodiment, the network described in S2 is each operator network, each lower-level operator network and each large enterprise internal network.

[0036] Step S3: Match and compare each session information with the botnet command and control instruction feature data set, identify and record the session information that meets the instruction characteristics, and record the botnet command and control log. The command and control log includes communication time, instruction type, botnet IP, botnet communication port, C2IP, C2 port, botnet family, and communication session data.

[0037] Step S4: Real-time correlation is performed between the command and control log and the domain name request log in the network traffic, and the domain name requests before and during the access period of the zombie chicken accessing the C2IP are analyzed to obtain the domain name whose resolution value is C2IP, i.e., the C2 control domain name. The command and control log adds the C2 control domain name field, which specifically includes the following sub-steps:

[0038] Step S41: Set a time threshold Ns, and obtain a bot domain name access request log from the communication time between the bot and C2IP - Ns to the communication time between the bot and C2IP;

[0039] Step S42: Analyze the domain name request log obtained in step S41 to obtain the domain name whose resolution value is C2IP, i.e., the C2 controlled domain name;

[0040] Step S43: Set the time threshold Nt, and add the C2 control domain name field to the log of the same C2IP in the botnet command and control log within the time period from the communication time between the bot and C2IP - Nt to the communication time between the bot and C2IP + Nt. The control domain name value is the C2 control domain name analyzed in step S42.

[0041] As an embodiment, in step S41, the time threshold Ns is 1 minute to 1 hour, and is set to 1 minute in this embodiment to obtain the broiler domain name access request log from 1 minute before the start of the communication between the broiler and the C2IP to the communication time between the broiler and the C2IP.

[0042] As an embodiment, in step S43, the time threshold Nt is 1 minute to 1 day, and is set to 15 minutes in this embodiment. The C2 control domain name field is added to the log of the same C2IP in the botnet command and control log from 15 minutes before the start of the communication between the bot and C2IP to 15 minutes after the end of the communication between the bot and C2IP. The control domain name value is the C2 control domain name analyzed in step S43.

[0043] Step S5: Analyze the command and control logs using the botnet control scale measurement algorithm, and calculate the cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs for each family, each C2 control domain name, and each C2IP address of the botnet.

[0044] Among them, the cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs of each botnet family, each C2 controlled domain name, and each C2IP address are all used to indicate the control scale and changing trend of the botnet, and to perceive and discover botnets with large control scale or rapidly expanding control scale by setting thresholds.

[0045] Among them, the cumulative number of communicating botnet IPs, the daily number of communicating botnet IPs, and the hourly number of communicating botnet IPs refer to the number of botnet IPs after deduplication in the command and control logs within a specific time range, that is, the number of different botnet IPs, which are used to represent the scale of the botnet within a specific time range.

[0046] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technician familiar with this profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical contents disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of the technical solution of the present invention.

Claims

1. A method for analyzing network traffic to measure the control scale of a botnet, characterized by: It includes the following steps: Step 1: Collect the exposed and discovered bot samples, extract the network session features of botnet command and control instructions through sample code reverse analysis or communication data analysis, and establish a botnet command and control instruction feature dataset; Step 2: Obtain the network inflow and outflow traffic according to the detection coverage, conduct in-depth analysis of the network inflow and outflow traffic through deep packet data inspection technology, and deeply read the content information of the IP message payload to reassemble and obtain complete session information; Step 3: Match and compare each session information with the botnet command and control instruction feature data set, identify and record the session information that meets the instruction features, and record the botnet command and control log. The command and control log includes communication time, instruction type, botnet IP, botnet communication port, C2IP, C2 port, botnet family, and communication session data; Step 4: Correlate the command and control logs with the domain name request logs in the network traffic in real time, analyze the domain name requests before and during the access period of the zombies to C2IP, obtain the domain name with the resolution value of C2IP, that is, the C2 control domain name, and add the C2 control domain name field to the command and control logs; Step 5: Use the botnet control scale measurement algorithm to analyze the command and control logs, and calculate the cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs for each botnet family, each C2 control domain name, and each C2IP address.

2. The method for analyzing network traffic and measuring the control scale of a botnet according to claim 1, characterized in that: The cumulative number of communicating botnet IPs, the number of communicating botnet IPs per day, the number of communicating botnet IPs per hour, the daily growth rate of the number of communicating botnet IPs, and the hourly growth rate of the number of communicating botnet IPs of each family, each C2 controlled domain name, and each C2IP address of the botnet are all used to indicate the control scale and changing trend of the botnet, and to perceive and discover botnets with large control scale or rapidly expanding control scale by setting thresholds.

3. A method for analyzing network traffic and measuring the control scale of a botnet according to any one of claims 1 to 2, characterized in that: Described step 4 specifically comprises the following steps: Step 4.1: Set the time threshold Ns, and obtain the bot domain name access request log from the communication time between the bot and C2IP - Ns to the communication time between the bot and C2IP; Step 4.2: Analyze the domain name request log obtained in step S41 to obtain the domain name whose resolution value is C2IP, i.e., the C2 controlled domain name; Step 4.3: Set the time threshold Nt, and add the C2 control domain name field to the logs of the same C2IP in the botnet command and control logs within the time period from the communication time between the bot and C2IP - Nt to the communication time between the bot and C2IP + Nt. The control domain name value is the C2 control domain name analyzed in step 4.

2.

4. The method for analyzing network traffic and measuring the control scale of a botnet according to claim 1, characterized in that: The botnet command and control instructions in step 1 are online instructions, heartbeat instructions, and data return instructions that the zombies send to C2 on a regular basis, or attack instructions and operation instructions that C2 sends to the zombies on a regular basis.

5. The method for analyzing network traffic and measuring the control scale of a botnet according to claim 1, characterized in that: The cumulative number of communicating botnet IPs, the daily number of communicating botnet IPs and the hourly number of communicating botnet IPs refer to the number of botnet IPs after deduplication in the command and control logs within a specific time range, that is, the number of different botnet IPs, which are used to represent the scale of the botnet within a specific time range.

6. The method for analyzing network traffic and measuring the control scale of a botnet according to claim 1, characterized in that: The networks are the networks of various operators, the networks of various subordinate operators and the internal networks of various large enterprises.

Images