Using coverage analysis to extract Botnet command-and-control protocol
There are some inherent patterns in the bot execution trace coverage of basic blocks.Using these patterns,an approach was proposed to infer Botnet command-and-control protocol (C&C protocol).Without intermediate representation of binary code and constraints solving,this approach has a lo...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | zho |
| Published: |
Editorial Department of Journal on Communications
2014-01-01
|
| Series: | Tongxin xuebao |
| Subjects: | |
| Online Access: | http://www.joconline.com.cn/zh/article/doi/10.3969/j.issn.1000-436x.2014.01.018/ |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | There are some inherent patterns in the bot execution trace coverage of basic blocks.Using these patterns,an approach was proposed to infer Botnet command-and-control protocol (C&C protocol).Without intermediate representation of binary code and constraints solving,this approach has a lower time and space overhead.This coverage analysis approach was evaluated on 3 famous Botnet:Zeus,Sdbot and Agobot.The result shows that this approach can accurately and efficiently extract the Botnet control commands.And the completeness of the extracted control commands could be verified by checking whether all available basic blocks in bot are covered by the traces triggered by the control commands. |
|---|---|
| ISSN: | 1000-436X |