基于虛擬低交互蜜罐檢測僵尸網(wǎng)絡(luò).pdf

1、Malware detection has become more difficult with the use of compression,polymorphic methods and techniques to detect and disable security sottware. Those andother obfuscation techniques pose a problem for detection and c

2、lassification schemes of malwares especially for botnets which are the most complicated forms for intemet crimes.The objective of this research is to detect the existence of botnets in the monitorednetwork by designing a

3、nd deployment of a distributed low-interaction honeypot, and toprovide clues from the detection for the threat evaluation by botnets propagation estimation. A distributed framework of nepenthes honeypots is built to coll

4、ect as more aspossible malware samples which are spreading on the network The configuration ofNepenthes is optimized to improve the capture efficiency. The collected malware samplesare analyzed firstly by features via an

5、tivirus scan, then by behavior via two onlinesandboxes. All data included in analysis reports is extracted and stored in database for theevaluation ofthe threats on the monitored network, and to study the propagation sch