스팸매일의 행동적 특성을 이용한 Rustock 봇넷 연구
Rustock botnet analysis using behavioral characteristics of spam mails
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
봇넷은 악성코드 감염으로 인하여 봇마스터에 의해 조종되는 봇 컴퓨터의 집합을 의미한다. 봇넷은 DDoS공격, 대 규모 스팸메일 발송, 개인정보 유출 등 다양한 악의적인 행동을 하며 현재 인터넷 사회의 가장 큰 위협이 되고 있 다. 이 논문에서는 4개월동안 34억개 이상의 대규모 이메일 로그와 Rustock 악성코드에 감염된 컴퓨터 IP를 이용 하여 스팸메일의 행동적 특성을 기반으로 Rustock 봇넷을 탐지하였다. 타데이터베이스를 이용하여 탐지된 Rustock 봇넷이 발송한 메일의 유효성을 검증하고, 발송패턴과 국가별 분포를 분석하였다.
Abstract
The botnet is a collection of compromised computers that have fallen under the control of bot master after being infected by malicious programs. The botnets are exploited for various purposes, including distributed denial of service (DDoS), mass spamming and stealing sensitive information. This is the primary security threat on the Internet today. In this paper, we present a method to uncover a specific botnet named Rustock, based on behavioral patterns using more than 3.4 billion email records over a period of 4 months and IPs which is infected by Rustock worms. We prove that spam mails were sent by Rustock botnet using a spam mail database. These include spamming behaviors, distributions of Rustock.
참고문헌 (22)
- "Russian gang hijacking PCs in vast scheme" (2008)[URL]
- K. Chiang, "A case study of the rustock rootkit and spam bot", In Proceedings of USENIX HotBots ’07 (2007)
- "DDoS 공격 피해액 최대 544억원 추정" (2009), 강진규[URL]
- "2008 Internet Security Trends" (2008)[URL]
- "Marshal8e6 TRACELabs, Marshal8e6 Security Threats: Email and Web Threats", ~ (2009)
- Y. Xie, "Spamming botnets: Signatures and characteristics", in Proc. ACM SIGCOMM (2008)
- Jangbok Kim, "Spam Filtering With Dynamically Updated URL Statistics", IEEE Security and Privacy, 5(4) (2007)
- G. Gu, "BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection", In Proceedings of the 17th USENIX Security Symposium (2008)
- "Bot software looks to improve peerage" (2006)[URL]
- J. B. Grizzard, "Peer-to-peer botnets: Overview and case study", In Proceedings of USENIX HotBots '07 (2007)
- T. Holz, "Measurements and mitigation of peer to peer based botnets: A case study on storm worm", In Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET '08) (2008)
- J. Goebel, "Rishi: Identify bot contaminated hosts by irc nickname evaluation", In Proceedings of USENIX HotBots’'07 (2007)
- A. Karasaridis, "Wide scale botnet detection and characterization", In Proceedings of USENIX HotBots ’07 (2007)
- W. T. Strayer, "Detecting botnets with tight command and control", In Proceedings of the 31st IEEE Conference on Local Computer Networks (LCN’'06) (2006)
- M. Prince, "Understanding How Spammers Steal Your E-Mail Address: An Analysis of the First Six Months of Data from Project Honey Pot", In Second Conference on Email and Anti-Spam (CEAS) (2005)
- L. Zhuang, "Characterizing botnets from email spam records", In LEET 08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats (2008)
- F. Li, "An empirical study of clustering behavior of spammers and group-based anti-spam strategies", In CEAS 2006: Proceedings of the 3rd conference on email and anti-spam (2006)
- A. Ramachandran, "Filtering spam with behavioral blacklisting", In Proceedings of 14th ACM Conference on Computer and Communications Security (CCS) (2007)
- "Spam I Got, an active catalog of unsolicited spam emails"[URL]
- "Attack of the Bots" (2006)[URL]
- "Bringing Geography to the Internet"[URL]