Journal of Computer Applications ›› 2015, Vol. 35 ›› Issue (6): 1698-1704.DOI: 10.11772/j.issn.1001-9081.2015.06.1698

Previous Articles     Next Articles

Construction of mobile botnet based on URL shortening services flux and Google cloud messaging for Android

LI Na1,2, DU Yanhui1, CHEN Mo1,3   

  1. 1. School of Cyber Security Defense, People's Public Security University of China, Beijing 100076, China;
    2. Command Center, Lunan Sub-Bureau of Tangshan Municipal Public Security Bureau, Tangshan Hebei 063000, China;
    3. Divsion of Exit-Entry Adiministration, Xiangyang Municipal Public Security Bureau, Xiangyang Hubei 441000, China
  • Received:2015-01-09 Revised:2015-03-19 Published:2015-06-12

基于短地址混淆和谷歌云推送的移动僵尸网络的构建

李娜1,2, 杜彦辉1, 陈默1,3   

  1. 1. 中国人民公安大学 网络安全保卫学院, 北京 100076;
    2. 唐山市公安局路南区分局 指挥中心, 河北 唐山 063000;
    3. 襄阳市公安局 出入境支队, 湖北 襄阳 441000
  • 通讯作者: 李娜(1979-),女,河北丰润人,助理工程师,博士研究生,主要研究方向:网络安全;n_li@163.com
  • 作者简介:杜彦辉(1969-),男,河北石家庄人,教授,博士生导师,博士,主要研究方向:网络安全;陈默(1987-),男,湖北襄阳人,硕士研究生,主要研究方向:网络安全。
  • 基金资助:

    国家自然科学基金资助项目(71173199);中央高校基本科研业务费资助项目(2014JKF01140,2014JKF01144)。

Abstract:

In order to enhance the defensive ability and prediction ability of mobile network,a method for constructing mobile botnet based on a URL Shortening Services Flux (USSes-Flux) and Google Cloud Messaging for Android (GCM) was proposed. The mobile botnet model was designed with hybrid topology of central structure and peer-to-peer (P2P), USSes-Flux algorithm was presented, which increased robustness and stealthiness of Command and Control (C&C) channel. The control model was discussed. The states change of different bot, command design and propagation algorithm were also analyzed. In the test environment, the relationship between probability of short URL invalidness and number of required short URL was discussed. The static analysis, dynamic analysis and power testing of the mobile botnet and the samples of different C&C channel were carried out. The results show that the proposed mobile botnet is more stealthy, robust and low-cost.

Key words: mobile botnet, Command and Control (C&C) channel, network model, cloud push, URL Shortening Services Flux (USSes-Flux)

摘要:

为了提升对移动僵尸网络的预测能力和防御能力,提出了一种基于短地址混淆(USSes-Flux)和谷歌云(GCM)推送的移动僵尸网络的构建机制。设计了基于中心结构和对等网络(P2P)混合的拓扑结构的移动僵尸网络模型,给出了USSes-Flux算法,从而增强了命令与控制信道的隐秘性和强壮性。给出了该移动僵尸网络的控制模型,分析了不同僵尸节点的状态改变、命令设计和传播算法。实验环境中,研究了短地址的失效率与申请数量之间的关系,并对该移动僵尸网络与不同命令和控制信道的样本进行静态分析、动态分析和电量测试。结果表明:该移动僵尸网络具有较强的隐秘性、强壮性和低消耗。

关键词: 移动僵尸网络, 命令与控制信道, 网络模型, 云推送, 短地址混淆

CLC Number: