Research on the reverse analyses and monitoring data of Mirai malware botnet

Ya-liang CHEN; Qin-yun DAI; Hai-yan WU; Zheng WEI

doi:10.11959/j.issn.2096-109x.2017.00181

您当前的位置：

首页 >

文章列表页 >

Research on the reverse analyses and monitoring data of Mirai malware botnet

Papers | 更新时间：2024-06-03

- Research on the reverse analyses and monitoring data of Mirai malware botnet
- Chinese Journal of Network and Information Security Vol. 3, Issue 8, Pages: 35-43(2017)
- 作者机构：
  
  1. 上海交通大学信息安全工程学院，上海 200240
  2. 国家计算机网络应急技术处理协调中心上海分中心，上海 201315
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00181
  CLC： TP309.5
- Online First：2017-08，
  
  Published：15 August 2017
- 稿件说明：
移动端阅览
Ya-liang CHEN, Qin-yun DAI, Hai-yan WU, et al. Research on the reverse analyses and monitoring data of Mirai malware botnet[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 35-43.
DOI：

Ya-liang CHEN, Qin-yun DAI, Hai-yan WU, et al. Research on the reverse analyses and monitoring data of Mirai malware botnet[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 35-43. DOI： 10.11959/j.issn.2096-109x.2017.00181.

摘要

近年来，随着物联网的兴起，以僵尸网络为代表的恶意程序正在逐渐向物联网领域渗透，已经出现利用物联网脆弱的安全防护进行传播并发动拒绝服务攻击的恶意代码。首先介绍了Mirai僵尸网络的整体架构，对其受控端和控制端等多个组件的主要功能进行了研究；然后对通过主动和被动方式获取的监测数据展开分析，并在此基础上，对Mirai僵尸网络恶意程序的监测发现和应对建议进行了讨论。

Abstract

In recent years

with the rapid development of Internet of things(IoT)

malwares have come into Internet of things

and botnet is the typical one.Malwares spreading through IoT vulnerable devices have emerged.The overall structure of Mirai botnet and the function of its components were introduced

such as bots and C＆amp;C server.The monitoring data obtained through active and passive way were analyzed.Based on that

the discovery methods and response modes on such kind of botnet malwares were discussed.

关键词

Keywords

references

MCCARTY B . Botnets:big and bigger [J ] . IEEE Security ＆ Privacy , 2003 , 1 ( 4 ): 87 - 90

STONE-GROSS B , COVA M , CAVALLARO L , et al . Your botnet is my botnet:analysis of a botnet takeover [C ] // The 16th ACM Conference on Computer and Communication Security . 2009 : 635 - 647 .

CUI X , FANG B X , YIN L H , et al . Andbot:towards advanced mobile botnets [C ] // The 4th Usenix Workshop on Large-scale Exploits and Emergent Threats . 2011 :11.

Linux/Mirai . How an old ELF malcode is recycled [EB/OL ] . http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just .html http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just .html .

World’s largest net:mirai botnet,client,echo loader,CNC source code released [EB/OL ] . https://hackforums.net/showthread.php?tid=5420472 https://hackforums.net/showthread.php?tid=5420472 .

Eir’s D1000 modem is wide open to being hacked [EB/OL ] . https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-mod em-is-wide-open-to-being-hacked/ https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-mod em-is-wide-open-to-being-hacked/ .

Trojan.Mirai.1 [EB/OL ] . https://vms.drweb.com/virus/?i= 14934685＆ lng= en https://vms.drweb.com/virus/?i= 14934685＆ lng= en .

Gartner says 8.4 billion connected "things" will be in use in 2017,up 31 percent from 2016 [EB/OL ] . http://www.gartner.com/newsroom/id/3598917 http://www.gartner.com/newsroom/id/3598917 .

汪胜聪 , 滕勤 , 左承基 . 综述单片机控制系统的抗干扰设计 [J ] . 现代电子技术 , 2003 , 1 : 7 - 9 .

WANG S C , TENG Q , ZUO C J . Statement of an-ti-disturbance design in the micro-controller system [J ] . Modern Electronic Technique , 2003 , 1 : 7 - 9 .

吴春敏 . 基于 TR-069 协议的远程配置管理终端的研究与实现 [D ] . 成都:西南交通大学 , 2006 .

WU C M . Research and implementation of remote configuration management terminal base in TR-069 protocol [D ] . Chengdu:Southwest Jiaotong University , 2006 .

张雪松 , 徐小琳 , 李青山 . 算法生成恶意域名的实时检测 [J ] . 现代电信科技 , 2013 , 7 : 3 - 8 .

ZHANG X S , XU X L , LI Q S . The real-time detection of algorithmically generated malicious domain [J ] . Modern Science ＆Technology of Telecommunications , 2013 , 7 : 3 - 8 .

钟馗之眼.网络空间搜索引擎 [EB/OL ] . https://www.zoomeye.org/ https://www.zoomeye.org/ .

ZoomEye.Cyberspace Search Engine [EB/OL ] . https://www.zoomeye.org/ https://www.zoomeye.org/ .

Shodan [EB/OL ] . https://www.shodan.io/ https://www.shodan.io/ .

Censys [EB/OL ] . https://www.censys.io/ https://www.censys.io/ .

FOFA Pro . 网络空间安全搜索引擎 [EB/OL ] . https://fofa.so/ https://fofa.so/ .

FOFA Pro . The cyberspace search engine [EB/OL ] . https://fofa.so/ https://fofa.so/ .

FREILING F , HOLZ T , WICHERSKI G . Botnet tracking:Exploring a root-cause methodology to prevent distributed denial-of- service at-tacks [C ] // The 10th European Symposium on Research in Computer Security (ESORICS 2005) . 2005 : 319 - 335 .

LI J H . Overview of the technologies of threat intelligence sensing,sharing and analysis in cyber space [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 2 ): 16 - 29 .

Views

5662

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Metric-based learning approach to botnet detection with small samples

Secure controlling method for scalable botnets

High resistance botnet based on smart contract

Method of botnet network nodes detection base on communication similarity

Related Author

Honggang LIN

Junjing ZHU

Lin CHEN

Qiang LIU

Pengfei LI

Zhangjie FU

Hao ZHAO

Hui SHU

Related Institution

School of Cyberspace Security, Chengdu University of Information Technology

Sichuan Key Laboratory of Advanced Cryptography and System Security

Anhui Key Laboratory of Cyberspace Security Situational Awareness and Assessment

College of Computer, National University of Defense Technology

School of Computer ＆Software, Nanjing University of Information Science ＆Technology

⁰