[论文解读] I Trust my Zombies: A Trust-enabled Botnet

Emmanouil Vasilomanolakis, Jan Wolf+3 more|TUbilio (Technical University of Darmstadt)|Dec 11, 2017

Network Security and Intrusion Detection参考文献 12被引用 3

一句话总结

本文提出了一种基于信任的机制，用于去中心化僵尸网络，使受感染的机器（僵尸机）能够自主检测并屏蔽监控传感器，采用计算信任模型。通过利用贝叶斯推断和受eBay模型启发的信任度量，与传统P2P僵尸网络相比，该系统将传感器的可见性降低了97%以上，显著增强了对检测和情报收集的抗性。

ABSTRACT

Defending against botnets has always been a cat and mouse game. Cyber-security researchers and government agencies attempt to detect and take down botnets by playing the role of the cat. In this context, a lot of work has been done towards reverse engineering certain variants of malware families as well as understanding the network protocols of botnets to identify their weaknesses (if any) and exploit them. While this is necessary, such an approach offers the botmasters the ability to quickly counteract the defenders by simply performing small changes in their arsenals. We attempt a different approach by actually taking the role of the Botmaster, to eventually anticipate his behavior. That said, in this paper, we present a novel computational trust mechanism for fully distributed botnets that allows for a resilient and stealthy management of the infected machines (zombies). We exploit the highly researched area of computational trust to create an autonomous mechanism that ensures the avoidance of common botnet tracking mechanisms such as sensors and crawlers. In our futuristic botnet, zombies are both smart and cautious. They are cautious in the sense that they are careful with whom they communicate with. Moreover, they are smart enough to learn from their experiences and infer whether their fellow zombies are indeed who they claim to be and not government agencies' spies. We study different computational trust models, mainly based on Bayesian inference, to evaluate their advantages and disadvantages in the context of a distributed botnet. Furthermore, we show, via our experimental results, that our approach is significantly stronger than any technique that has been seen in botnets to date.

研究动机与目标

• 解决研究人员和执法机构对P2P僵尸网络监控活动日益增长的检测与缓解挑战。
• 开发一种具有韧性的去中心化僵尸网络管理机制，避免依赖集中式C2基础设施及其相关的单点故障。
• 使僵尸机能够自主评估对等节点的可信度，并基于行为证据识别潜在的传感器或爬虫。
• 评估计算信任模型在降低P2P僵尸网络中监控工具的可见性和成功率方面的有效性。
• 证明基于信任的机制相较于现有的图论或协议异常检测类反监控技术具有更优的替代效果。

提出的方法

• 提出一种基于贝叶斯推断的计算信任模型，用于评估P2P僵尸网络中邻近僵尸机的可信度。
• 采用邻居列表（NL）机制，僵尸机定期交换hello消息以维持连接并验证对等节点的合法性。
• 实施声誉系统，每个僵尸机根据观察到的行为（如响应一致性与消息真实性）维护一个信任评分。
• 应用受eBay启发的信任模型，动态量化并更新信任值，使僵尸机能够检测并隔离可疑节点。
• 实施黑名单机制，将不可信的对等节点从邻居列表中移除，以防止与传感器通信。
• 使用成员管理（MM）周期，定期探测邻居节点，并用经过验证的节点替换无响应或不可信的节点。

实验结果

研究问题

• RQ1 计算信任模型能否在P2P僵尸网络环境中有效区分合法僵尸机与监控传感器？
• RQ2 与传统的协议层异常检测相比，贝叶斯推断的集成如何提升传感器节点的检测能力？
• RQ3 基于信任的机制在多大程度上能降低研究人员或执法机构部署的传感器的可见性和有效性？
• RQ4 在模拟僵尸网络环境中，该系统在真实网络波动和对抗性条件下的表现如何？
• RQ5 不同信任模型（如eBay模型与基本声誉模型）对传感器检测准确率和僵尸网络韧性的影晌如何？

主要发现

• 所提出的基于信任的机制相比原始Sality僵尸网络协议，将传感器的流行度降低了97%以上，显著限制了研究人员收集网络情报的能力。
• 受eBay启发的信任模型在检测和隔离传感器节点方面优于基本声誉系统，因其能够建模不确定性并根据新证据动态更新信念。
• 计算信任使僵尸机能够实现无需集中控制或预定义签名的自主、去中心化对等节点验证。
• 该系统在高网络波动和对抗性探测条件下仍表现出韧性，通过基于行为一致性的动态更新信任评分实现。
• 结果表明，基于信任的机制相较于现有反监控技术实现了显著进步，而后者正日益被此类自适应防御手段所规避。
• 本研究强调了迫切需要开发新型、更隐蔽的监控技术，因为传统基于传感器的方法在面对此类具备信任感知能力的坚韧僵尸网络时已逐渐失效。