easy. The purpose of this study is to estimate the group size of Fast-Flux Service Network FFSN.. Uses Joint hypergeometric maximum likelihood estimat

Size: px

Start display at page:

Download "easy. The purpose of this study is to estimate the group size of Fast-Flux Service Network FFSN.. Uses Joint hypergeometric maximum likelihood estimat"

乖胡
5 years ago
Views:

1 第十六卷第一期 2014 年 3 月 (pp.1~16) a b,* a b FFSN agent FFSN FFSN FFSN-Agent Flux-Agent Bot FFSN Fast-Flux Service Network FFSN Capture-Recapture Method CRM Joint hypergeometric maximum likelihood estimator JHE Flux-Agent Estimating Population Size of Fast-Flux Domain - Using Joint Hypergeometric Maximum Likelihood Estimator Method Tung-Ming Koo a Hung-Chang Chang b a Department of Information Management, National Yunlin University of Science and Technology b Graduate Institute of Information Management, National Yunlin University of Science and Technology Abstract FFSN is one of the enormous threats of internet. It can hide the attackers behind a group of agents and by this way the attackers can avoid being detected. The benefit of FFSN to attackers is the malicious websites can be protected and the survival time can be prolonged. The danger of FFSN is getting more serious and Flux-Agent could be a Bot note. To estimate the size of FFSN can find the danger degree but to estimate the size is not * 通訊作者電子郵件 :g @yuntech.edu.tw DOI: /JEB (1).01 March

2 easy. The purpose of this study is to estimate the group size of Fast-Flux Service Network FFSN.. Uses Joint hypergeometric maximum likelihood estimator JHE of Capture- Recapture Method CRM to estimate the group size of Flux-Agent. By computing the joint hypergeometric maximum likelihood estimator JHE of Program NOREMARK, the group size can be found. The experiment result can find the group size more quickly than census. Keywords: Capture-Recapture, Fast-Flux Service Networks, Size Estimation 1. National Crime Squad High Tech Crime Team 2010 Bredolab Botnet Botnet Parket, 2012 Fast-Flux Service Networks FFSN FFSN DNS FFSN Round Robin DNS RR-DNS 2003 DNS agent Google Yahoo Fast-Flux Fast-Flux phishing 2009 FFSN IP ATLAS Malware Domain List 2 March 2014

3 Capture-Recapture Method CRM Joint hypergeometric maximum likelihood estimator JHE Flux-Agent 2 3 FFSN JHE Round Robin DNS(RR-DNS) RR-DNS IP Client DNS IP Client 2003 RR-DNS (1) DNS RR-DNS (2) DNS (3) Client 2.2 Botnet Bot IRC Channel Bot IRC Channel Scharrenberg, IRC Bot SubSeven V2.1 Bot Bächer et al., 2007 Botnet Botnet Botmaster Botmaster Bot Bot Saha and Gairola, 2005 Botnet March

4 DDoS Botmaster Botnet Spammer 50, ,000 Botnet Click fraud Daswani and Stoppelman, Fast-Flux Service Network(FFSN) FFSN agent FFSN DNS Botnet Honeynet Project Project, 2007 FFSN fully qualified domain name, FQDN IP IP Round-Robin Time-To- Live, TTL IP FFSN FFSN agent TTL Client DNS HTTP MotherShip MotherShip 1 Honeynet Project Project, 2007 FFSN single-flux double-flux FFSN Single-Flux Service Networks 2 eventdraw.com Fast-Flux domain (1) DNS server eventdraw.com (2) DNS server Fast-Flux DNS server 4 March 2014

5 1 Holz et al., single-flux Scharrenberg, 2008 (3) Fast-Flux DNS server eventdraw.com IP (4) DNS server IP (5) IP FF Agent March

6 (6) FF Agent Mothership Web server (7) Mothership Web server FF Agent (8) FF Agent Mothership agents Mothership DNS server FFSN single-flux networks Double-Flux Service Networks 如圖 3 為 double-flux networks 的範例跟 single-flux 不同的是 name server, 是連結到其中一個 agent, 而不是連結至 Fast-Flux name server, 再經由 agent 轉送請求到 Fast-Flux name server, 之後回傳給請求的 name server, 這樣一來就無法確認 Fast- Flux name server 的 IP 位址 Honeynet Project Project, 2007 FFSN (1) single-flux networks DNS agent A Record 3 10 (2) FFSN agent 3 double-flux Scharrenberg, March 2014

7 (3) double-flux networks round-robin A Record IP double-flux domain NS record 2007 FFSN fast-flux command and control C&C HTTP protocol 2012 Persisci FFSN FFSN FFSN Persisci et al., 重複捕取法 Capture-Recapture Method CRM 2006 closed Lincoln-Petersen open Jolly-Seber Jolly, Mane P2P Capture-Recapture Method CRM P2P Capture-Recapture Method P2P Mane et al., Weaver Collins Netcraft Castlecops netblocks Weaver and Collins, P2P Holz March

8 Fast-Flux Domain Flux-Agent Holz et al., P2P Botnet P2P Botnet Botnet peer list P2P Botnet P2P Botnet Koo et al., 族群估計 Lincoln-Petersen Lincoln-Petersen Program CAPTURE ; Jolly Seber Program SURGE Program POPAN Program NOREMARK Program MARK ProgramCARE Program NOREMARK Krebs, 1999 Program NOREMARK Program NOREMARK Joint hypergeometric maximum likelihood estimator JHE Immigration-emigration Minta and Mangel estimator Bowden's estimator Joint hypergeometric maximum likelihood estimator Minta and Mangel estimator Bowden's estimator Immigration-emigration Joint hypergeometric maximum likelihood estimator JHE Lincoln-Petersen i FFSN agent FFSN FFSN 8 March 2014

9 Joint hypergeometric maximum likelihood estimator JHE FFSN FFSN 4 FFSN A Record JHE 4 FFSN JHE (1) 一般在 DNS ZONE TTL 預設在 86400S 1 天, 在研究前期實驗中發現最大族群族 TTL 10S 數量為 3266, 所需耗費時間為秒, 表示在 DNS CACHE 更新前能將所有族群數量 QUERY 出來 (2) FFSN agent 在一個區段時間內其大小不會有任何變動 (3) 因為 FFSN 是使用 RR-DNS 技術來運作, 因此在 dig 網域名稱時其所被捕獲的 A Record 機率是相等的 (4) 因為規模估計 FFSN 皆是透過實驗系統自動記錄, 並儲存至資料庫記錄, 所以並不會有脫落或誤判的情形發生 FFSN JHE FFSN Fast-Flux Domain DNS query A Record query Fast-Flux Agent Fast-Flux March

10 Domain Agent A Record DNS query TTL Time To Live TTL TTL Unit JHE T i m i n i (1) T i i (2) m i i i (3) n i i JHE i m i T i N Ti mi ni mi P r ( mi N Ti ni), i 1 k (1) N n N joint likelihood function i T i N Ti k mi ni mi L( N Ti n i mi ), i 1 k (2) i 1 N n maximum likelihood estimator, MLE JHE Closed Population Model Estimation 1 1 Chapman 1951 N N i ( n 1)( 1) i Ti N 1, i 1 k (3) m 1 i 資料來源 Fast-Flux Domain FFSN ATLAS - Arbor Networks Malware Domain List 10 March 2014

11 2010/ /08 Domain 1340 DNS query 系統環境 IP FFSN Domain Agent A Record A Record A Record Google DNS Server IP: 實證資料 JHE a % TTL *10 * JHE Fast-Flux Domain a 0.05 TTL 5 5 JHE IP TTL Unit (1) IP TTL Units TTL 10s 2000 Agent (2) IP TTL Units TTL 10s 1300 Agent March

12 (3) IP TTL *50 *370 TTL Units TTL 300s 3600s TTL Agent erosocialka.ru 6 TTL 200 JHE % % 200 TTL Units JHE erosocialka.ru erosocialka.ru DNS query 1340 Domain GEPHI Layout 結果討論 FFSN JHE TTL Fast-flux Domain (1) IP TTL Units TTL 10s 2000 Agent 12 March 2014

13 FFSN (2) IP TTL Units TTL 10s 1300 Agent (3) IP TTL *50 *370 TTL Units TTL 300s 3600s TTL Agent TTL FFSN Fast-Flux Domain A Record IP dartzofmybpull.ru shokoladdeath.ru 7 A Record Botnet 5. Fast-Flux Service Network FFSN FFSN March

14 FFSN FFSN BOT FFSN 5.1 結論 (1) JHE FFSN TTL FFSN Fast-Flux Domain 14 FFSN (2) A Record botnet (3) FFSN (4) Domain Agent IP IP LIST Domain IP LIST ISP 5.2 未來研究方向 TTL FFSN 8 25 TTL 200 FFSN TTL P2P March 2014

15 25 FFSN 2009 DNS -Fast-Flux RR-DNS 2003 Bächer, P., Holz, T., Kötter, M., & Wicherski, G. (2008). Know your enemy: Tracking botnets. Retrieved October 29, 2009, from Daswani, N., & Stoppelman, M. (2007). The anatomy of Clickbot A. Proceedings of USENIX HotBots 07, Cambridge, USA. Holz, T., Gorecki, C., Rieck, K., & Freiling, F. C. (2008). Measuring and detecting fast-flux service networks. NDSS Symposium 2008, San Diego, USA. Jolly, G. M. (1965). Explicit estimates from capture-recapture data with both death and immigration-stochastic model. Biometrika, 52 (1/2), Krebs, C. J. (1999). Ecological methodology (2nd ed.). USA: Benjamin Cummings. Koo, T. M., Chang, H. C., & Liao, W. C. (2012). Estimating the size of P2P botnets. International Journal of Advancements in Computing Technology, 4 (12), Mane, S., Mopuru, S., Mehra, K., & Srivastava, J. (2005). Network size estimation in a peer-to-peer network (TR ). MN, USA: Department of Computer Science and Engineering, University of Minnesota. March

16 Parket, L. (2010). Dutch national crime squad announces takedown of dangerous botnet. Retrieved January. 27, 2014, from dutch_national_crime/ Persisci, R., Corona, I., & Giacinto, G. (2012). Early detection of malicious flux networks via large-scale passive DNS traffic analysis. IEEE Transactions on Dependable and Secure Computing, 9 (5), Salusky, W., & Danford, R. (2007). Know your enemy: Fast-flux service networks. Retrieved October 29, 2009, from Saha, B., & Gairola, A. (2005). Botnet: An overview. India: Indian Computer Emergency Response Team. Scharrenberg, P. (2008). Analyzing fast-flux service networks. Unpublished master s dissertation, University of Aachen, Germany. Weaver, R., & Collins, M. (2007). Fishing for phishes: Applying capture-recapture methods to estimate phishing populations. Proceedings of the anti-phishing working groups 2nd annual ecrime researchers summit, NY, USA. 16 March 2014

山东省招生委员会

山东省招生委员会附件 2: 2012 年度山东大学精品课程申报表课程名称课程负责人所属院系网站建设与设计连莉副教授计算机学院课程类型理论课 ( 不含实践 ) 理论课 ( 含实践 ) 实践 ( 验 ) 课所属专业大类所属专业类理工电子信息科学类联系电话 13256167020