CN102014025B - Method for detecting P2P botnet structure based on network flow clustering - Google Patents

Abstract

The invention discloses a method for detecting a P2P botnet structure based on network flow clustering. The method uses a real-time communication data acquisition module, a datagram record filter module, a network flow extraction module, a network flow record filter module, and a network flow clustering module. , data association and result display modules have completed the detection of the P2P botnet structure. The basic idea is that the defender uses the regularity of the command and control communication between the nodes of the P2P botnet, that is, the duration, the number of datagrams, the byte Quantity, etc. have characteristics, by identifying the command and control communication in the monitored network communication data to determine the P2P botnet nodes in the monitored network and the command and control relationship between nodes, and then give the P2P botnet structure; the main purpose of the present invention The innovation point is that the communication network flows with similar characteristics are gathered together by the clustering method, and compared with the characteristics of the command and control communication feature set, the normal communication and the P2P botnet communication are distinguished, so as to achieve the purpose of detecting the structure of the P2P botnet.

Description

A Method of Detecting P2P Botnet Structure Based on Network Flow Clustering

technical field

The invention relates to a method for discovering network structure, more particularly, a method for detecting P2P botnet structure based on network flow clustering.

Background technique

Botnets are a network composed of a large number of computer programs that control computer resources without authorization and can accept remote control commands to perform corresponding operations. It is a new attack method evolved from the form of traditional malicious code. It provides attackers with a hidden, flexible and efficient one-to-many command and control mechanism, which can control a large number of zombie hosts to achieve information theft and distributed denial of service attacks. and spam sending and other attack purposes; among them, the one-to-many command and control mechanism is its essential feature. An attacker is a computer or person who, by using a computer network, takes actions to disrupt, block, impair or destroy information residing on a computer and its computer network, or the computer and its network itself.

A defender is someone who takes a range of actions to protect, monitor, analyze, detect and respond to unauthorized activity within a computer network and its information systems.

The command and control mechanism of the botnet has various modes: centralized, P2P mode and random mode. The characteristic of the P2P botnet is that there is a peer-to-peer relationship between nodes (zombie processes), there is no typical command and control server in the network, and the servent nodes in the network can serve as both clients and servers. Compared with centralized botnets, P2P botnets are not easy to be detected and have stronger concealment.

Referring to Figure 1, there are 9 nodes in total including A node, B node, C node, D node, E node, F node, G node, H node, and I node. Together with the control activity C&C, it forms a P2P botnet structure. The attacker can transmit the attack command AI _n through some preset nodes, and the nodes in the P2P botnet can spread the attack command AI _n to each node in the network through the command and control activity C&C; All nodes of will interpret the attack instruction AI _n and execute the corresponding attack activity AA, and the attack activity AA will cause damage to the network and information system of the attacked party.

Contents of the invention

The purpose of the present invention is to propose a method for detecting P2P botnet structure based on network flow clustering. The sequential execution of the class module, data association and result display module completes the detection of the structure of the P2P botnet. The number of bytes has characteristics, by identifying the command and control communication in the monitored network communication data to determine the P2P botnet nodes in the monitored network and the command and control relationship between nodes, and then give the P2P botnet structure; the present invention The main innovation of this technology is that the communication network flows with similar characteristics are gathered together by clustering method, compared with the characteristics of the command and control communication feature set, and the normal communication is distinguished from the P2P botnet communication, so as to achieve the purpose of detecting the P2P botnet structure .

A kind of method of detecting P2P botnet structure based on network flow clustering of the present invention, this method comprises following detection steps:

Step 1: Collect real-time communication data

The real-time communication data acquisition module first obtains the IP datagram IPD of the monitored network from the monitored network, and extracts the key field KF={SIP, DIP, SPT, DPT, IHL, ITL, THL, PTL}; then record the acquisition time T _t of the current acquisition IP datagram IPD; finally in the key field KF={SIP, DIP, SPT, DPT, IHL, ITL, THL, PTL} The source IP address SIP, destination IP address DIP, source port number SPT, destination port number DPT, IP datagram protocol field type PTL, as well as collection time T _t and application layer message length AML are expressed as a datagram record PR stored in In the datagram record table PRT; the datagram record PR is expressed as PR=(SIP, DIP, SPT, DPT, PTL, T _t , AML) according to the tuple form in mathematics;

Step 2: Filter datagram records

The datagram record filtering module filters out the datagram record PR in the datagram record table PRT according to the first filter rule set FFR;

Step 3: Extract the network stream

The network flow extraction module first accepts the timeout interval TO input by the defender; then according to the network flow extraction strategy FEP, the datagram record PR in the datagram record table PRT is processed according to the order of the collection time T _t ;

Step 4: Filter Network Flow Records

The network flow record filtering module filters out irrelevant network flow records according to the second filtering rule set SFR;

Step 5: Perform network flow clustering

The network flow clustering module first accepts the command and control feature set CCFFT input by the defender; then uses the maximum and minimum method MM to normalize the data of the network flow feature FFT of the network flow record FR in the network flow record table FRT; The network flow records FR in the network flow record table FRT are clustered, and one or more clusters whose cluster centers are close to the features in the command and control feature set CCFFT are used as the P2P botnet command and control network flow set CCS;

Step 6: Display the Results

The data association and result display module first extracts the IP address set IPS in the command and control network flow set CCS; then represents each IP address in the IP address set IPS as a point, and in the command and control network flow set Draw an edge between the source IP address SIP and the destination IP address DIP corresponding to each network flow record FR in the CCS; the obtained points and edges constitute the P2P botnet structure detected by the defender.

Description of drawings

Figure 1 is a schematic diagram of a conventional P2P botnet structure.

Fig. 2 is a schematic diagram of the present invention detecting P2P botnet structure.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments.

A kind of method of detecting P2P botnet structure based on network flow clustering of the present invention, this method comprises following detection steps:

Step 1: Collect real-time communication data

The first aspect of the real-time communication data acquisition module obtains the IP datagram IPD of the monitored network from the monitored network, and extracts the key field KF from the IP datagram IPD;

The key field KF includes source IP address SIP, destination IP address DIP, source port number SPT, destination port number DPT, IP header length IHL, IP datagram total length ITL, TCP/UDP header length THL , IP datagram protocol field type PTL; according to the set expression form in mathematics, it is KF={SIP, DIP, SPT, DPT, IHL, ITL, THL, PTL}.

In the present invention, when the PTL is the same as the TCP protocol, ITL-IHL-THL is used to calculate the application layer message length AML.

In the present invention, when the PTL is the same as the UDP protocol, ITL-IHL-THL+8 is used to calculate the application layer message length AML.

TCP (Transmission Control Protocol), transmission control protocol. TCP can provide a reliable end-to-end byte stream communication over an unreliable Internet network.

UDP (User Datagram Protocol), User Datagram Protocol. UDP can provide a method for applications to send encapsulated IP datagrams, and these IP datagrams can be sent without establishing a connection.

The second aspect of the real-time communication data acquisition module records the time information of the current acquisition IP datagram IPD, which is recorded as T _t (abbreviated as acquisition time T _t );

In the third aspect of the real-time communication data collection module, source IP address SIP, destination IP address DIP, source port number SPT, destination port number DPT, IP datagram protocol field type PTL in the key field KF, and collection time T _t , application layer message length AML is represented as a datagram record PR stored in the datagram record table PRT; said datagram record PR is expressed as PR=(SIP, DIP, SPT, DPT according to the tuple form in mathematics , PTL, T _t , AML).

Step 2: Filter datagram records

The datagram record filtering module filters out the datagram records PR in the datagram record table PRT according to the first filtering rule set FFR.

In the present invention, the first aspect of the first filter rule set FFR includes the protocol type filter rule PFR; the datagram record filter module deletes the protocol field type PTL in the datagram record table PRT that is different from the protocol type filter rule PFR datagram record PR;

In the present invention, the second aspect of the first filter rule set FFR includes a whitelist filter rule WLFR; the whitelist filter rule WLFR includes the IP address trusted by the defender; the datagram record filter module deletes the datagram record table PRT The source IP address SIP or the destination IP address DIP is the same as the datagram record PR of the white list filter rule WLFR;

In the present invention, the third aspect of the first filter rule set FFR includes a blacklist filter rule BLFR; the blacklist filter rule BLFR includes the IP address suspected by the defender; the datagram record filter module deletes the datagram record table In the PRT, the source IP address SIP or the destination IP address DIP is different from the datagram record PR of the blacklist filtering rule BLFR.

Step 3: Extract the network stream

Network flow record FR includes source IP address SIP, destination IP address DIP, source port number SPT, destination port number DPT, protocol type PTL, start time ST, end time ET, datagram number PN, byte number BN, network flow duration Time DRT, the average number of bytes per datagram BPP, the average number of datagrams per second PPS, the average number of bytes per second BPS; the network flow record FR is expressed as FR=( SIP, DIP, SPT, DPT, PTL, ST, ET, PN, BN, DRT, BPP, PPS, BPS); the network flow record FR is stored in the network flow record table FRT.

The quintuple FT comprises a tuple composed of source IP address SIP, destination IP address DIP, source port number SPT, destination port number DPT, IP datagram protocol field type PTL; The group form is expressed as FT=(SIP, DIP, SPT, DPT, PTL).

The network flow characteristic FFT comprises the network flow duration DRT, the average number of bytes per datagram BPP, the average number of datagrams per second PPS, and the average number of bytes per second BPS; The tuple form is expressed as FFT=(DRT, BPP, PPS, BPS).

The network flow characteristic FFT is calculated according to the network flow characteristic calculation policy FFTCP.

The network flow feature calculation strategy FFTCP uses ST-ET to calculate the network flow duration DRT, uses BN/PN to calculate the average number of bytes per datagram BPP, and uses PN/DRT to calculate the average data per second report the number of PPS, and use BN/DRT to calculate the average number of bytes per second BPS.

The first aspect of the network flow extraction module accepts the timeout interval input by the defender, which is recorded as TO (referred to as the timeout time TO);

The second aspect of the network flow extraction module is to process the datagram records PR in the datagram record table PRT according to the sequence of the collection time T _t according to the network flow extraction policy FEP.

In the present invention, the first aspect of the network flow extraction strategy FEP searches the network flow record table FRT for the network whose quintuple FT is the same as the start time ST of the quintuple FT of the datagram record PR. flow record FR;

If there is the network flow record FR, and the collection time T _t of the datagram record PR and the start time ST of the network flow record FR satisfy that T _t -ST is less than or equal to the timeout time TO, then according to the datagram record PR updates the network flow record FR: the end time ET of the network flow record FR is equal to the collection time T _t of the datagram record PR; the datagram quantity PN of the network flow record FR is equal to the current value plus 1; the The number of bytes BN of the network flow record FR is equal to the current value plus the application layer message length AML of the datagram record PR; recalculate the network flow duration DRT, average each The number of datagram bytes BPP, the average number of datagrams per second PPS, the average number of bytes per second BPS.

If there is the network flow record FR, and the acquisition time T _t of the datagram record PR and the start time ST of the network flow record FR satisfy that T _t -ST is greater than the timeout time TO, then the network flow A new network flow record FR is inserted in the record table FRT; the start time ST of the network flow record FR is equal to the collection time T _t of the datagram record PR; the datagram quantity PN of the network flow record FR is equal to 1; The number of bytes BN of the network flow record FR equals the application layer message length AML of the datagram record PR; calculate the network flow duration DRT according to the network flow characteristic calculation strategy FFTCP, and average each datagram word The number of sections BPP, the average number of datagrams per second PPS, and the average number of bytes per second BPS.

If the network flow record FR does not exist, insert a new network flow record FR into the network flow record table FRT; the start time ST of the network flow record FR is equal to the collection time T of the datagram record PR _t ; the datagram quantity PN of the network flow record FR is equal to 1; the byte quantity BN of the network flow record FR is equal to the application layer message length AML of the datagram record PR; according to the network flow characteristic calculation strategy FFTCP calculates the network flow duration DRT, the average number of bytes per datagram BPP, the average number of datagrams per second PPS, and the average number of bytes per second BPS.

Step 4: Filter Network Flow Records

The network flow record filtering module filters out irrelevant network flow records according to the second filtering rule set SFR.

In the present invention, the first aspect of the second filtering rule set SFR includes a special communication filtering rule SCFR; the special communication filtering rule SCFR includes a datagram number PN of 1 and a byte number BN of 0; network flow record filtering The module deletes the network flow record FR in the network flow record table FRT that is the same as the network flow record FR of the special communication filtering rule SCFR;

In the present invention, the second aspect of the second filter rule set SFR includes P2P communication filter rule PPFR; the P2P communication filter rule PPFR includes the network flow feature FFT as a specific value; the network flow record filter module Delete the network flow record FR whose network flow characteristic FFT is the same as the P2P communication filtering rule PPFR in the network flow record table FRT.

Step 5: Perform network flow clustering

The first aspect of the network flow clustering module accepts the command and control network flow feature set input by the defender, which is recorded as CCFFT (referred to as the command and control feature set CCFFT);

The second aspect of the network flow clustering module uses the maximum and minimum method MM to normalize the data of the network flow feature FFT of the network flow record FR in the network flow record table FRT;

The maximum and minimum value method MM is to take the minimum value MIN in the data set, the maximum value MAX in the data set, and then each data D in the data set is equal to D-MIN divided by MAX-MIN.

The third party of the network flow clustering module clusters the network flow records FR in the network flow record table FRT, and uses one or more clusters whose cluster center points are close to the features in the command and control feature set CCFFT as P2P Botnet command and control network flow set CCS.

Step 6: Display the Results

The first aspect of the data association and result display module extracts the source IP address SIP and the destination IP address DIP in the command and control network flow set CCS, which is recorded as the command and control IP address set IPS (IP address set IPS for short);

In the second aspect of the data association and result display module, each IP address in the IP address set IPS is represented as a point, and the source IP address SIP and destination IP address corresponding to each network flow record FR in the command and control network flow set CCS An edge is drawn between the IP addresses DIP; the resulting points and edges constitute the P2P botnet structure detected by the defender.

The present invention has the advantage of detecting the P2P botnet structure method based on network flow clustering:

①Using the characteristics of P2P botnets, the nodes in the network are used as monitoring nodes (watchlist), or as filtering rules for data to be analyzed, reducing the amount of data to be processed.

② Using the network flow depiction method, the applicability of the method based on network flow clustering to detect the P2P botnet structure is improved, so it can handle both the command and control communication based on the TCP protocol and the command and control communication based on the UDP protocol.

③ The method of the present invention combines network packet filtering and network flow filtering. That is to filter the network data packets first, and reduce the input data for extracting the network flow and its characteristic activities, so as to improve the efficiency of this activity. Then perform network flow filtering to reduce the data size of network flows and improve the efficiency of network flow clustering analysis.

④ The method of the present invention detects and gives the structure of the P2P botnet, which can promote the network defender's understanding and understanding of the working mechanism of the P2P botnet, and then propose more effective defense measures.

Claims (6)

1. a Basing on network fluid cluster detects the method for P2P Botnet structure, it is characterized in that this method includes following detection step:

Step 1: gather real-time communication data

The real-time communication data acquisition module at first obtains the IP datagram IPD of this monitored network from monitored network, and from described IP datagram IPD, extracts critical field KF={SIP, DIP; SPT, DPT, IHL; ITL; THL, PTL}, IP head length IHL, IP datagram total length ITL, TCP/UDP head length THL; Note the acquisition time Tt of current collection IP datagram IPD then; At last with described critical field KF={SIP, DIP, SPT; DPT; IHL, ITL, THL; Source IP address SIP among the PTL}, purpose IP address D IP, source port number SPT, destination slogan DPT, IP datagram protocol fields type PTL, and acquisition time Tt, application layer message length AML are expressed as a datagram record PR and are stored among the datagram record sheet PRT; Said datagram record PR according to the tuple form in the mathematics be expressed as PR=(SIP, DIP, SPT, DPT, PTL, Tt, AML);

Step 2: filtering data newspaper record

Datagram record filtering module filters out the datagram record PR among the said datagram record sheet PRT according to the first filtering rule set FFR;

The described first filtering rule set FFR first aspect comprises protocol type filtering rule PFR; Protocol fields type PTL is different from the datagram record PR of said protocol type filtering rule PFR among the datagram record filtering module deleted data newspaper record sheet PRT; Second aspect comprises white list filtering rule WLFR; Said white list filtering rule WLFR comprises the IP address that the defender trusts; Source IP address SIP or purpose IP address D IP are same as the datagram record PR of said white list filtering rule WLFR among the datagram record filtering module deleted data newspaper record sheet PRT; The third aspect comprises blacklist filtering rule BLFR; Described blacklist filtering rule BLFR comprises the IP address that the defender suspects; Source IP address SIP or purpose IP address D IP are different from the datagram record PR of said blacklist filtering rule BLFR among the datagram record filtering module deleted data newspaper record sheet PRT;

Step 3: extract network flow

The network flow abstraction module is at first accepted the timeout interval TO of defender's input; Extract tactful FEP according to network flow then, according to the datagram record PR among the sequencing processing said data newspaper record sheet PRT of said acquisition time Tt;

Step 4: screen stream record

Network flow record filtering module filters out irrelevant network flow record according to the second filtering rule set SFR; The described second filtering rule set SFR first aspect comprises specific communication filtering rule SCFR; Said specific communication filtering rule SCFR comprises that datagram quantity PN is 1, bytes in BN is 0; Network flow record FR is same as the network flow record FR of said specific communication filtering rule SCFR among the network flow record filtering module deletion network flow record sheet FRT; Second aspect comprises P2P communication filtering rule PPFR; It is a certain particular value that described P2P communication filtering rule PPFR comprises said network flow characteristic FFT; Network flow characteristic FFT is same as the network flow record FR of said P2P communication filtering rule PPFR among the network flow record filtering module deletion network flow record sheet FRT;

Step 5: carry out the network flow cluster

Network flow cluster module is at first accepted the order and the controlling features collection CCFFT of defender's input; Utilize maximin method MM that the network flow characteristic FFT of the record of the network flow among network flow record sheet FRT FR carry out data requirementization then; At last the record of the network flow among network flow record sheet FRT FR is carried out cluster, cluster centre point is ordered and Control Network adfluxion CCS as the P2P Botnet near one or more cluster of characteristic among said order and the controlling features collection CCFFT; Said maximin method MM is the concentrated minimum value MIN of fetching data; Data centralization maximum MAX, each data of data centralization

then

Step 6: display result

Data related and as a result display module at first extract the IP address set IPS among said order and the Control Network adfluxion CCS; Then each the IP address table among the IP address set IPS is shown a point, limit of drafting between the source IP address SIP that each network flow record FR is corresponding in said order and Control Network adfluxion CCS, the purpose IP address D IP; Constituted the detected P2P Botnet of defender structure by point that obtains and limit.

2. Basing on network fluid cluster according to claim 1 detects the method for P2P Botnet structure, it is characterized in that: in step 1, when PTL is same as Transmission Control Protocol, utilize ITL-IHL-THL to come computing application layer message length AML.

3. Basing on network fluid cluster according to claim 1 detects the method for P2P Botnet structure, it is characterized in that: in step 1, when PTL is same as udp protocol, utilize ITL-IHL-THL+8 to come computing application layer message length AML.

4. Basing on network fluid cluster according to claim 1 detects the method for P2P Botnet structure; It is characterized in that: in step 4, network flow record FR comprise source IP address SIP, purpose IP address D IP, source port number SPT, destination slogan DPT, protocol type PTL, time started ST, concluding time ET, datagram quantity PN, bytes in BN, network flow duration DRT, on average each datagram bytes in BPP, average each second datagram quantity PPS, average each second bytes in BPS; With said network flow record FR according to the tuple form in the mathematics be expressed as FR=(SIP, DIP, SPT, DPT, PTL, ST, ET, PN, BN, DRT, BPP, PPS, BPS); Said network flow record FR is stored among the network flow record sheet FRT.

5. Basing on network fluid cluster according to claim 1 detects the method for P2P Botnet structure; It is characterized in that: in step 4, said network flow characteristic FFT comprise network flow duration DRT, on average each datagram bytes in BPP, average each second datagram quantity PPS, average each second bytes in BPS; With said network flow characteristic FFT according to the tuple form in the mathematics be expressed as FFT=(DRT, BPP, PPS, BPS).

6. according to the method for claim 1 or 5 described Basing on network fluid clusters detection P2P Botnet structures, it is characterized in that: in step 4, said network flow characteristic FFT calculates according to network flow feature calculation strategy FFTCP; Said network flow feature calculation strategy FFTCP utilizes ST-ET to calculate said network flow duration DRT; Utilize BN/PN to calculate said average each datagram bytes in BPP; Utilize PN/DRT to calculate said average each second of datagram quantity PPS, utilize BN/DRT to calculate said average each second of bytes in BPS.

Images