Search

To defeat botnets and ensure cyberspace security,a novel social network-based botnet with strong destroy-resistance (DR-SNbot),as well as its corresponding countermeasure,was proposed.DR-SNbot constructed command and control servers (C＆C-Servers) based on social network.Each C＆C-Server corresponded to a unique pseudo-random nickname.The botmaster issues commanded by hiding them in diaries using information hiding techniques,and then a novel C＆C channel was established.When different proportions of C＆C-Servers were invalid,DR-SNbot would send out different levels of alarms to inform attackers to construct new C＆C-Servers.Then,DR-SNbot could automatically repair C＆C communication to ensure its strong destroy-resistance.Under the experimental settings,DR-SNbot could resume the C＆C communication in a short period of time to keep 100% of the control rate even if all the current C＆C-Servers were invalid.Finally,a botnet nickname detecting method was proposed based on the difference of lexical features of legal nicknames and pseudo-random nicknames.Experimental results show that the proposed method can effectively (precision:96.88%,recall:93%) detect pseudo-random nicknames generated by social network-based botnets with customized algorithms.

To defeat botnets and ensure cyberspace security,a novel social network-based botnet with strong destroy-resistance (DR-SNbot),as well as its corresponding countermeasure,was proposed.DR-SNbot constructed command and control servers (C＆C-Servers) based on social network.Each C＆C-Server corresponded to a unique pseudo-random nickname.The botmaster issues commanded by hiding them in diaries using information hiding techniques,and then a novel C＆C channel was established.When different proportions of C＆C-Servers were invalid,DR-SNbot would send out different levels of alarms to inform attackers to construct new C＆C-Servers.Then,DR-SNbot could automatically repair C＆C communication to ensure its strong destroy-resistance.Under the experimental settings,DR-SNbot could resume the C＆C communication in a short period of time to keep 100% of the control rate even if all the current C＆C-Servers were invalid.Finally,a botnet nickname detecting method was proposed based on the difference of lexical features of legal nicknames and pseudo-random nicknames.Experimental results show that the proposed method can effectively (precision:96.88%,recall:93%) detect pseudo-random nicknames generated by social network-based botnets with customized algorithms.

A novel method for fast and accurately tracing reused code was proposed. Based on simhash and inverted in-dex, the method can fast trace similar functions in massive code. First of all, a code database with three-level inverted in-dex structures was constructed. For the function to be traced, similar code blocks could be found quickly according to simhash value of the code block in the function code. Then the potential similar functions could be fast traced using in-verted index. Finally, really similar functions could be identified by comparing jump relationships of similar code blocks. Further, malware samples containing similar functions could be traced. The experimental results show that the method can quickly identify the functions inserted by compilers and the reused functions based on the code database under the premise of high accuracy and recall rate.

A novel method for fast and accurately tracing reused code was proposed. Based on simhash and inverted in-dex, the method can fast trace similar functions in massive code. First of all, a code database with three-level inverted in-dex structures was constructed. For the function to be traced, similar code blocks could be found quickly according to simhash value of the code block in the function code. Then the potential similar functions could be fast traced using in-verted index. Finally, really similar functions could be identified by comparing jump relationships of similar code blocks. Further, malware samples containing similar functions could be traced. The experimental results show that the method can quickly identify the functions inserted by compilers and the reused functions based on the code database under the premise of high accuracy and recall rate.