Botnet management method and device based on deep protocol reverse analysis and storage medium
By simulating real systems and devices in a virtual environment, and performing in-depth protocol reverse engineering and node relationship graph construction, the shortcomings of traditional botnet governance methods are addressed, enabling accurate detection and automated defense against botnets, and improving network security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 15 INST OF CHINA ELECTRONICS TECH GRP
- Filing Date
- 2025-10-15
- Publication Date
- 2026-05-12
Smart Images
Figure CN121396575B_ABST
Abstract
Description
Technical Field
[0001] The embodiments disclosed herein relate to the field of network security detection technology, and more specifically, to a method, apparatus, and computer-readable storage medium storing computer programs for botnet management based on deep protocol reverse analysis. Background Technology
[0002] With the development of the internet and the widespread adoption of IoT devices, cybersecurity issues are becoming increasingly serious. In particular, botnets have become a major threat in the cybersecurity field. Botnets consist of a large number of computers infected with malware, which are remotely controlled by hackers to carry out various attack activities, such as distributed denial-of-service (DDoS) attacks, information theft, and spam distribution.
[0003] Traditional botnet management methods mostly rely on firewalls, intrusion detection systems, and antivirus software, but these methods are often ineffective against encrypted communications and malicious behavior disguised as normal traffic. Summary of the Invention
[0004] The embodiments described herein provide a botnet governance method, apparatus, and computer-readable storage medium storing computer programs based on deep protocol reverse analysis. By deeply analyzing the communication protocols of botnets and constructing a virtual environment disguised as a real C&C network, botnet nodes can be effectively attracted and captured, thereby enabling control and governance.
[0005] According to a first aspect of this disclosure, a botnet governance method based on deep protocol reverse analysis is provided, comprising: deploying multiple high-interaction honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices to lure bot nodes; acquiring data packets between bot nodes and honeypots, performing reverse analysis on the communication protocols in the data packets to obtain protocol analysis results; based on the protocol analysis results, constructing a virtual C&C communication network to simulate the attacker's communication protocol and send forged instructions to connected bot nodes; recording node information connected to the virtual C&C communication network and constructing a node relationship graph based on the node information; identifying abnormal behavior patterns based on the node relationship graph, and triggering defense or countermeasure mechanisms when abnormal behavior is detected.
[0006] In some embodiments of this disclosure, multiple highly interactive honeypots are deployed in virtual machines or containers to simulate real operating systems, application services, or IoT devices to lure botnet nodes. This includes: exposing SMB services in the honeypot to simulate a Windows system, and using weak passwords on the SMB services to attract targeted attacks; simulating IoT devices, setting default weak passwords or exposing exploitable services to attract attackers to connect; and recording relevant behavioral information, including IP addresses, accessed services, and transmitted data packets, when botnet nodes or attackers attempt to connect to the honeypot.
[0007] In some embodiments of this disclosure, data packets between the zombie node and the honeypot are acquired, and the communication protocol in the data packets is reverse-engineered to obtain the protocol analysis results, including: capturing the first 100 data packets between the zombie node and the honeypot through a protocol reverse engineering engine; determining whether the data packets are encrypted through entropy analysis and identifying the encryption method; if the communication protocol uses XOR round-robin key encryption, then the key replacement pattern is deduced by comparing the ciphertext and plaintext relationship of multiple captured data packets.
[0008] In some embodiments of this disclosure, based on protocol analysis results, constructing a virtual C&C communication network to simulate an attacker's communication protocol and send forged instructions to connected zombie nodes includes: using a virtual C&C communication network that is similar to a real C&C server in terms of IP address, port, protocol, and authentication mechanism; simulating an attacker's communication protocol to send forged instructions to connected zombie nodes and responding to requests from zombie nodes.
[0009] In some embodiments of this disclosure, recording node information connected to the virtual C&C communication network and constructing a node relationship graph based on the node information includes: collecting and recording the IP address, online time, communication frequency, communication protocol, response time, and behavior pattern information of each node connected to the virtual C&C communication network; constructing a node relationship graph based on the collected node information, where nodes represent zombie nodes and edges represent communication associations between nodes; identifying which nodes communicate frequently within a certain time period and whether they have cooperative behavior with other zombie nodes by statistically analyzing the communication frequency of nodes and their association with other nodes; combining the geographical location of IP addresses to analyze which areas of zombie nodes have strong cooperative relationships through network topology analysis; and searching for potential abnormal behaviors or hidden subsets of the zombie network based on clustering analysis and association rule analysis.
[0010] In some embodiments of this disclosure, identifying abnormal behavior patterns based on node relationship graphs and triggering defense or countermeasure mechanisms when abnormal behavior is detected includes: real-time monitoring of the request frequency and number of connections for each node; recording the timestamp, source IP address, and request type whenever a node initiates a request or establishes a connection; using a sliding time window to calculate the number of requests and connections in real time; marking a node as a high-risk node if the number of requests within the sliding time window exceeds a preset threshold; isolating high-risk nodes from other network components to prevent them from continuing to communicate with the virtual C&C communication network; or sending forged security vulnerabilities or erroneous instructions to high-risk nodes to guide them to perform harmless operations.
[0011] In some embodiments of this disclosure, the method further includes: updating the node relationship graph when a new node joins or the behavior of an existing node changes; and optimizing the defense strategy based on real-time feedback obtained from the honeypot and virtual C&C communication network and the updated node relationship graph.
[0012] According to a second aspect of this disclosure, a botnet governance device based on deep protocol reverse analysis is provided. The device includes at least one processor and at least one memory storing a computer program. When the computer program is executed by the at least one processor, the device causes the following actions: deploying multiple highly interactive honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices, and trapping botnet nodes; acquiring data packets between botnet nodes and honeypots, performing reverse analysis on the communication protocols in the data packets to obtain protocol analysis results; based on the protocol analysis results, constructing a virtual C&C communication network to simulate an attacker's communication protocol and send forged instructions to connected botnet nodes; recording node information connected to the virtual C&C communication network and constructing a node relationship graph based on the node information; and identifying abnormal behavior patterns based on the node relationship graph, triggering a defense mechanism or countermeasure mechanism when abnormal behavior is detected.
[0013] According to a third aspect of this disclosure, a computer-readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the botnet management method based on deep protocol reverse analysis according to the first aspect of this disclosure.
[0014] The botnet management method and apparatus based on deep protocol reverse analysis according to embodiments of this disclosure can discover not only known attack patterns but also unknown and variant attack methods by reverse analyzing the communication protocols in data packets, thus improving the accuracy of botnet detection. Based on the results of reverse protocol analysis, the constructed node relationship graph can accurately record information of all nodes connected to the virtual C&C communication network, thereby effectively identifying abnormal behavior patterns. Once an anomaly is detected, corresponding defense or countermeasure mechanisms can be quickly triggered, such as automatically isolating abnormal nodes, blocking attack paths, and adjusting access control policies. This intelligent and automated defense mechanism enables rapid response, reduces human intervention, and improves network security. Attached Figure Description
[0015] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein:
[0016] Figure 1 An exemplary flowchart of a botnet governance method based on deep protocol reverse analysis according to an embodiment of the present disclosure is shown;
[0017] Figure 2 This is a schematic block diagram of a botnet management device based on deep protocol reverse analysis according to embodiments of the present disclosure.
[0018] It should be noted that the elements in the attached diagram are schematic and not drawn to scale. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.
[0020] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having meanings consistent with their meanings in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. Furthermore, terms such as “first” and “second” are used only to distinguish one component (or part of a component) from another component (or another part of a component).
[0021] This disclosure proposes a botnet management scheme that aims to deceive and control infected bot nodes by simulating a real control network environment, while simultaneously tracking and interrupting malicious network activities through reverse engineering of network protocols. When encountering a botnet attack, this scheme not only discovers and analyzes bot nodes but also proactively counters and combats attackers through a virtual control network.
[0022] To further explain the embodiments of this disclosure in detail, Figure 1 An exemplary flowchart illustrating a botnet governance method based on deep protocol reverse engineering according to embodiments of the present disclosure is shown. Figure 1 At frame S102, deploy multiple highly interactive honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices to lure zombie nodes.
[0023] High-interaction honeypots provide a system that closely resembles a real-world environment, allowing attackers to perform more complex operations. For example, attackers can execute commands, upload files, and run malicious scripts, making the honeypot more attractive to attackers. According to one embodiment of this disclosure, virtualization technologies such as VMware, KVM, and Docker can be used to create multiple virtual machines, each simulating an operating system environment or application service. Alternatively, Docker or Kubernetes can be used to deploy a containerized honeypot environment.
[0024] Each honeypot masquerades as a device with a real operating system (Windows, Linux, IoT devices) and services (SSH, FTP, HTTP, SMTP, etc.), deliberately enabling known vulnerabilities or misconfigurations (such as opening unnecessary ports, using default passwords, or using unpatched operating systems) to lure attackers into connecting. It targets vulnerabilities commonly exploited by hackers, such as Windows SMB service vulnerabilities, weak passwords on IoT devices, and specific application vulnerabilities. For example, the honeypot exposes an SMB service to simulate a Windows system, especially an unpatched older version. The SMB service provides file and printer sharing services between different computers on the local area network. Weak passwords, such as "password123" or "admin123," are used on the SMB service to attract targeted attacks. Similarly, it simulates IoT devices with default weak passwords, such as "123456," "admin," or "root," or exposes exploitable services like Telnet, HTTP, and FTP to attract attackers into connecting.
[0025] Configure network traffic monitoring tools, such as Wireshark or Suricata, in the honeypot to capture intrusion traffic in real time and analyze attack characteristics. Once a botnet node or attacker attempts to connect to the honeypot, record relevant behavioral information, including IP address, accessed services, and transmitted data packets. This information can be used to identify the behavioral patterns of botnet nodes or attackers.
[0026] Subsequently, in box S104, data packets between the zombie node and the honeypot are obtained, and the communication protocol in the data packets is reverse-analyzed to obtain the protocol analysis results.
[0027] In one embodiment of this disclosure, after a zombie node successfully connects to the honeypot, the protocol reverse engineering engine captures the first 100 data packets between the zombie node and the honeypot. These data packets contain initial communication information and possible encryption modes. Entropy analysis is used to determine whether the data packets are encrypted and to identify the encryption method. Entropy analysis is a technique that determines whether data is encrypted by analyzing the randomness of the information distribution in a data packet. For a data stream, the entropy value of each byte can be calculated. A higher entropy value indicates a more uniform data distribution, suggesting potentially encrypted data; a lower entropy value suggests potentially plaintext data. The distribution characteristics of the entropy value can be used to determine whether the data is encrypted; for example, an entropy value greater than 0.7 indicates that the data may be encrypted.
[0028] Next, we can further deduce the encryption method. Common encryption methods include symmetric encryption, such as AES and DES, and encryption based on simple algorithms, such as XOR round-robin encryption. Advanced symmetric encryption may exhibit higher entropy values and more complex data structures. If certain regular data offsets or repetitive patterns are found in the data packets, such as bit-by-bit rotation or the use of linear feedback shift registers to generate the key stream, it indicates that XOR encryption is used. If the communication protocol is found to use XOR round-robin key encryption, the key change pattern can be deduced by comparing the ciphertext and plaintext of multiple captured data packets. For example, some bytes may remain consistent across data packets, indicating that the same key is used to encrypt these parts. Once the key change pattern is found, the specific value of the key can be deduced through known plaintext attacks or by guessing the plaintext of known parts. After deducing part of the key, other data packets can be decrypted in reverse, and the attacker's operation can be interfered with by spoofing a legitimate response.
[0029] Next, in box S106, based on the protocol analysis results, a virtual C&C communication network is constructed to simulate the attacker's communication protocol and send forged instructions to the connected zombie nodes.
[0030] Command and control communication (C&C) consists of a client and a server. The client can send commands and control information over the network, while the server can receive and execute these commands. In some embodiments of this disclosure, a virtual C&C communication network can be designed to mimic a real C&C server, using IP addresses, ports, protocols, and authentication mechanisms similar to those of a real C&C server. By simulating the attacker's communication protocol and sending forged instructions to connected zombie nodes, and responding to requests from the zombie nodes, the attacker can simulate real C&C operations, making the attacker believe that these nodes are real and executing commands. For example, for the XOR encrypted communication protocol, the encrypted data stream can be simulated, and a key deduction mechanism can be attempted. When using the HTTP protocol, forged instructions with GET or POST requests can be constructed; if it is the IRC protocol, IRC messages can be simulated. The zombie nodes are instructed to perform specific actions, such as executing distributed denial-of-service (DDoS) attacks, spreading malware, or stealing information. These control instructions appear to originate from a real C&C server, but are actually only used to observe the behavioral patterns of the zombie nodes or to further verify their identity.
[0031] In box S108, the node information connected to the virtual C&C communication network is recorded, and a node relationship graph is constructed based on the node information.
[0032] Each zombie node that establishes a connection with the virtual C&C network server will be recorded and analyzed in detail. Recorded information includes: IP address, online time, communication frequency, communication protocol, response time, and behavioral patterns. A graph model is constructed based on the node's IP address, online time, and communication frequency. A node relationship graph is built based on the collected node information. Nodes in the node relationship graph represent zombie nodes, and edges represent communication relationships between nodes. For example, if two zombie nodes have similar online times and communication patterns, a strong association edge can be established between them. Through time series analysis, combined with the node's online time, a graph under time flow is constructed. For example, nodes that go online within a certain time period may have similar behaviors, and the edges in the graph can be weighted according to time intensity and the closeness of node behavior.
[0033] By utilizing big data analytics in node relationship graphs, potential connections and malicious activity patterns among zombie nodes can be discovered. The main analysis process includes:
[0034] By analyzing the communication frequency of nodes and their correlation with other nodes, we can identify which nodes communicate frequently within a certain time period and whether they cooperate with other zombie nodes. Nodes communicating frequently may be the master node or a collaborative operation of multiple child nodes. Combining the geographical location of IP addresses, network topology analysis can reveal that zombie nodes in certain regions may have strong cooperative relationships. For example, nodes from different regions exhibiting similar behaviors may indicate a cross-border or cross-regional botnet. By comparing the behavioral patterns of normal nodes and zombie nodes, data mining techniques (such as cluster analysis and association rule analysis) can be used to find potential abnormal behaviors or hidden subsets of botnets. For example, using clustering algorithms such as K-means and DBSCAN to group zombie nodes with similar behaviors together can reveal potential correlations between nodes; for example, the same controller may simultaneously control a group of zombie nodes with similar behaviors. Social network analysis techniques can be used to analyze the strength of relationships between nodes, identifying the core control node, peripheral nodes, and their potential interaction methods within the botnet.
[0035] Network graph visualization can show node concentration, that is, whether certain nodes are key nodes or "core nodes" in the network. For example, multiple nodes may communicate with the C&C server through it, which could be a proxy node or relay server of the C&C. It can also identify a group of nodes that may be controlled by the same control center.
[0036] Finally, in box S110, abnormal behavior patterns are identified based on the node relationship graph, and defense or countermeasure mechanisms are triggered when abnormal behavior is detected.
[0037] By analyzing the communication patterns and activity times of zombie nodes, abnormal behavior patterns can be identified. In one embodiment of this disclosure, the request frequency and connection count of each node are monitored in real time. Whenever a node initiates a request or establishes a connection, the timestamp, source IP address, and request type of the request are recorded. A sliding time window is used to calculate the number of requests and connections in real time. If the number of requests within the sliding time window exceeds a preset threshold, it is marked as a high-risk node. For example, if a node initiates more than 500 abnormal requests or more than 100 abnormal connections within 10 minutes of the sliding time window, it is immediately identified as a high-risk node.
[0038] Once a high-risk node is identified, defensive or countermeasure mechanisms are activated. For example, the node is isolated from other parts of the network, preventing it from continuing to communicate with the virtual C&C network and thus preventing the spread of malicious commands. A detailed attack report is generated, recording the source of the malicious behavior, its scope of impact, and countermeasures, for subsequent security analysis and handling. Based on node relationship graphs and big data analysis, the attack source is further traced to identify potential controllers.
[0039] Countermeasures can also be taken through reverse penetration, such as sending forged security vulnerabilities or erroneous commands to high-risk nodes to guide them to perform harmless operations, causing zombie nodes to "self-destruct" or cease malicious activity. IP addresses exhibiting malicious behavior should be blocked or alerted, and network firewalls should be used to further strengthen security protection.
[0040] Furthermore, the node relationship graph is updated when new nodes join or the behavior of existing nodes changes. For example, a new bot node establishes a connection with the virtual C&C communication network, or new bot node behaviors are detected, such as command propagation and coordination between bot nodes. Defense strategies are optimized based on real-time feedback from the honeypot and the virtual C&C communication network, as well as the updated node relationship graph. Through the interaction between the honeypot and the virtual C&C communication network, the latest behavioral characteristics of attackers can be continuously obtained, and defense strategies can be optimized through a continuous feedback mechanism. As more bot node connections and behavioral data are collected, the node relationship graph is dynamically updated, further revealing the complexity of the botnet and potential attack sources, enabling timely detection and effective countermeasures before attackers cause serious damage.
[0041] Figure 2 This is a schematic block diagram of a botnet management device based on deep protocol reverse engineering according to embodiments of this disclosure. Figure 2 As shown, the device 200 may include a processor 210 and a memory 220 storing a computer program. When the computer program is executed by the processor 210, the device 200 is made capable of performing actions such as... Figure 1 The steps of the method shown.
[0042] In one example, device 200 can be a computer device or a cloud computing node. Device 200 can deploy multiple highly interactive honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices to lure zombie nodes; acquire data packets between zombie nodes and honeypots, reverse engineer the communication protocols in the data packets to obtain protocol analysis results; based on the protocol analysis results, construct a virtual C&C communication network to simulate the attacker's communication protocol and send forged instructions to connected zombie nodes; record the node information connected to the virtual C&C communication network and construct a node relationship graph based on the node information; identify abnormal behavior patterns based on the node relationship graph, and trigger defense or countermeasure mechanisms when abnormal behavior is detected.
[0043] In the embodiments of this disclosure, the device 200 can expose SMB services in the honeypot to simulate a Windows system, use weak passwords on the SMB services to attract targeted attacks; simulate IoT devices, set default weak passwords or expose exploitable services to attract attackers to connect; when a bot node or attacker attempts to connect to the honeypot, record relevant behavioral information, including IP address, accessed services, and transmitted data packets.
[0044] In the embodiments of this disclosure, the device 200 can capture the first 100 data packets between the zombie node and the honeypot through a protocol reverse engineering engine; determine whether the data packets are encrypted by entropy analysis and identify the encryption method; if the communication protocol uses XOR round-robin key encryption, the key replacement pattern can be deduced by comparing the ciphertext and plaintext relationship of the captured multiple data packets.
[0045] In embodiments of this disclosure, device 200 can use IP addresses, ports, protocols, and authentication mechanisms similar to those of a real C&C server to impersonate a virtual C&C communication network that is a real C&C server; it can simulate the communication protocols of an attacker, send forged instructions to connected zombie nodes, and respond to requests from zombie nodes.
[0046] In the embodiments of this disclosure, the device 200 can collect and record the IP address, online time, communication frequency, communication protocol, response time, and behavior pattern information of each node connected to the virtual C&C communication network; construct a node relationship graph based on the collected node information, where nodes represent zombie nodes and edges represent communication associations between nodes; identify which nodes communicate frequently within a certain time period and whether they have cooperative behavior with other zombie nodes by statistically analyzing the communication frequency of nodes and their association with other nodes; combine the geographical location of IP addresses to analyze which areas of zombie nodes have strong cooperative relationships through network topology analysis; and find potential abnormal behaviors or hidden subsets of the zombie network based on clustering analysis and association rule analysis.
[0047] In the embodiments of this disclosure, the device 200 can monitor the request frequency and connection count of each node in real time. Whenever a node initiates a request or establishes a connection, it records the timestamp of the request, the source IP address, and the request type. It uses a sliding time window to calculate the number of requests and connections in real time. If the number of requests within the sliding time window exceeds a preset threshold, it is marked as a high-risk node. The high-risk node is isolated from other parts of the network so that it cannot continue to communicate with the virtual C&C communication network. Alternatively, it sends a forged security vulnerability or erroneous instruction to the high-risk node to guide it to perform a harmless operation.
[0048] In embodiments of this disclosure, the device 200 can update the node relationship graph when a new node is added or the behavior of an existing node changes; and optimize the defense strategy based on real-time feedback obtained from the honeypot and virtual C&C communication network and the updated node relationship graph.
[0049] In embodiments of this disclosure, processor 210 may be, for example, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a processor based on a multi-core processor architecture, etc. Memory 220 may be any type of memory implemented using data storage technologies, including but not limited to random access memory, read-only memory, semiconductor-based memory, flash memory, disk storage, etc.
[0050] Furthermore, in embodiments of this disclosure, device 200 may also include input device 230, such as a keyboard, mouse, etc. Additionally, device 200 may also include output device 240, such as a display, etc.
[0051] In other embodiments of this disclosure, a computer-readable storage medium storing a computer program is also provided, wherein the computer program, when executed by a processor, is capable of performing the following functions: Figure 1 The steps of the botnet governance method based on deep protocol reverse analysis are shown.
[0052] In summary, the botnet management method and apparatus based on deep protocol reverse analysis according to embodiments of this disclosure, through the deployment of high-interaction honeypots and the implementation of deep protocol analysis, can accurately capture bot nodes and deduce their communication protocols. Based on the results of reverse protocol analysis, the constructed node relationship graph can accurately record the information of all nodes connected to the virtual C&C communication network, thereby effectively identifying abnormal behavior patterns. Once an anomaly is detected, corresponding defense or countermeasure mechanisms can be quickly triggered, such as automatically isolating abnormal nodes, blocking attack paths, and adjusting access control policies. This intelligent and automated defense mechanism can achieve rapid response, reduce human intervention, and improve network security.
[0053] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses and methods according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0054] Unless otherwise expressly indicated by the context, the singular form of words used herein and in the appended claims includes the plural form, and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the terms “comprising” and “including” shall be interpreted as including rather than exclusively. Likewise, the terms “including” and “or” shall be interpreted as including unless such interpretation is expressly prohibited herein. Where the term “example” is used herein, particularly when it follows a set of terms, “example” is merely exemplary and illustrative and should not be considered exclusive or extensive.
[0055] Further aspects and scope of adaptation become apparent from the description provided herein. It should be understood that various aspects of this application may be implemented individually or in combination with one or more other aspects. It should also be understood that the descriptions and specific embodiments herein are for illustrative purposes only and are not intended to limit the scope of this application.
[0056] Several embodiments of this disclosure have been described in detail above. However, it is obvious that those skilled in the art can make various modifications and variations to the embodiments of this disclosure without departing from the spirit and scope of this disclosure. The scope of protection of this disclosure is defined by the appended claims.
Claims
1. A botnet governance method based on deep protocol reverse analysis, characterized in that, The method includes: Deploy multiple highly interactive honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices and lure zombie nodes. The data packets between the zombie node and the honeypot are obtained, and the communication protocol in the data packets is reverse-analyzed to obtain the protocol analysis results. Based on the protocol analysis results, a virtual C&C communication network is constructed to simulate the attacker's communication protocol and send forged instructions to the connected zombie nodes; Record node information connected to the virtual C&C communication network and construct a node relationship graph based on the node information. This includes: collecting and recording the IP address, online time, communication frequency, communication protocol, response time, and behavior pattern information of each node connected to the virtual C&C communication network; constructing a node relationship graph based on the collected node information, where nodes represent zombie nodes and edges represent communication associations between nodes; identifying which nodes communicate frequently within a certain time period and whether they cooperate with other zombie nodes by statistically analyzing the communication frequency of nodes and their association with other nodes; combining the geographical location of IP addresses to analyze network topology to identify which areas of zombie nodes have strong cooperative relationships; and searching for potential abnormal behaviors or hidden subsets of the zombie network based on clustering analysis and association rule analysis; and Based on the node relationship graph, abnormal behavior patterns are identified. When abnormal behavior is detected, defense or countermeasure mechanisms are triggered, including: real-time monitoring of the request frequency and connection count of each node; recording the timestamp, source IP address, and request type whenever a node initiates a request or establishes a connection; using a sliding time window to calculate the number of requests and connections in real time; if the number of requests within the sliding time window exceeds a preset threshold, it is marked as a high-risk node; isolating the high-risk node from other network components, preventing it from continuing to communicate with the virtual C&C communication network; or sending forged security vulnerabilities or erroneous instructions to the high-risk node to guide it to perform harmless operations.
2. The botnet management method based on deep protocol reverse analysis according to claim 1, characterized in that, The deployment of multiple highly interactive honeypots in virtual machines or containers to simulate real operating systems, application services, or IoT devices to lure zombie nodes includes: Exposing an SMB service within a honeypot to simulate a Windows system, and using weak passwords on the SMB service to attract targeted attacks; Simulate IoT devices, set weak default passwords, or expose exploitable services to lure attackers into connecting; and When a zombie node or attacker attempts to connect to a honeypot, relevant behavioral information is recorded, including IP address, accessed services, and transmitted data packets.
3. The botnet governance method based on deep protocol reverse analysis according to claim 1, characterized in that, The process of obtaining data packets between the zombie node and the honeypot, and performing reverse analysis on the communication protocol in the data packets to obtain protocol analysis results includes: Capture the first 100 packets between the zombie node and the honeypot using a protocol reverse engineering engine; Entropy analysis is used to determine whether the data packet is encrypted and to identify the encryption method. If the communication protocol uses XOR round-robin key encryption, the key replacement pattern can be deduced by comparing the ciphertext and plaintext of multiple captured data packets.
4. The botnet management method based on deep protocol reverse analysis according to claim 1, characterized in that, Based on the protocol analysis results, constructing a virtual C&C communication network to simulate an attacker's communication protocol and sending forged instructions to connected zombie nodes includes: A virtual C&C communication network is created by using IP addresses, ports, protocols, and authentication mechanisms similar to those of a real C&C server; Simulates the attacker's communication protocol, sends forged commands to connected zombie nodes, and responds to the zombie nodes' requests.
5. The botnet management method based on deep protocol reverse analysis according to claim 1, characterized in that, The method further includes: The node relationship graph is updated when a new node is added or the behavior of an existing node changes. Based on real-time feedback obtained from honeypots and virtual C&C communication networks, as well as updated node relationship graphs, defense strategies are optimized.
6. A botnet management device based on deep protocol reverse analysis, characterized in that, The device includes: At least one processor; and At least one memory storing a computer program; When the computer program is executed by the at least one processor, the device performs the steps of the botnet governance method based on deep protocol reverse analysis according to any one of claims 1 to 5.
7. A computer-readable storage medium storing a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the botnet management method based on deep protocol reverse analysis according to any one of claims 1 to 5.