基于覆盖率分析的僵尸网络控制命令发掘方法.pdfVIP

第35 卷第1 期 通 信 学 报 Vol.35 No. 1 20 14 年1 月 Journal on Communications January 20 14 doi:10.3969/j.issn.1000-436x.2014.01.018 基于覆盖率分析的僵尸网络控制命令发掘方法 王志，蔡亚运，刘露，贾春福 （南开大学 计算机与控制工程学院，天津 300071 ） 摘 要：从僵尸程序执行轨迹对二进制代码块的覆盖规律出发，提出了一种僵尸网络控制命令发掘方法。通过分 析执行轨迹对代码块的覆盖率特征实现对僵尸网络控制命令空间的发掘，根据代码空间是否被全覆盖来验证发现 的僵尸网络命令空间的全面性。对僵尸网络Zeus 、SdBot、AgoBot 的执行轨迹进行了代码块覆盖率分析，结果表 明，该方法能够快速准确地发掘出僵尸网络的控制命令集合，时间和空间开销小，且该命令集合所对应的执行轨 迹可以覆盖僵尸程序95% 以上的代码空间。 关键词：恶意代码分析；僵尸网络；命令与控制协议；基本块；覆盖率 中图分类号：TP393.08 文献标识码：A 文章编号：1000-436X(2014)01-0156-11 Using coverage analysis to extract Botnet command-and-control protocol WANG Zhi, CAI Ya-yun, LIU Lu, JIA Chun-fu (College of Computer and Control Engineering, Nankai University, Tianjin 300071, China) Abstract: There are some inherent patterns in the bot execution trace coverage of basic blocks. Using these patterns, an approach was proposed to infer Botnet command-and-control protocol (CC protocol). Without intermediate representa- tion of binary code and constraints solving, this approach has a lower time and space overhead. This coverage analysis approach was evaluated on 3 famous Botnet: Zeus, Sdbot and Agobot. The result shows that this approach can accurately and efficiently extract the Botnet control commands. And the completeness of the extracted control commands could be veri- fied by checking whether all available basic blocks in bot are covered by the traces triggered by the control commands. Key words: malware analysis; B