Scalability Optimization of Virtualization Based Botnet Emulation Platform

Li Ruan; Bo Lin; Limin Xiao

doi:10.3969/j.issn.1000-0801.2013.10.013

您当前的位置：

首页 >

文章列表页 >

Scalability Optimization of Virtualization Based Botnet Emulation Platform

research and development | 更新时间：2024-06-05

- Scalability Optimization of Virtualization Based Botnet Emulation Platform
- Telecommunications Science Vol. 29, Issue 10, Pages: 72-79(2013)
- 作者机构：
  
  1. 北京航空航天大学软件开发环境国家重点实验室北京100191
  2. 北京航空航天大学计算机学院北京100191
- 作者简介：
- 基金信息：
- DOI：10.3969/j.issn.1000-0801.2013.10.013
  CLC：
- Published Online：2013-10，
  
  Published：20 October 2013
- 稿件说明：
移动端阅览
Li Ruan, Bo Lin, Limin Xiao. Scalability Optimization of Virtualization Based Botnet Emulation Platform[J]. Telecommunications science, 2013, 29(10): 72-79.
DOI：

Li Ruan, Bo Lin, Limin Xiao. Scalability Optimization of Virtualization Based Botnet Emulation Platform[J]. Telecommunications science, 2013, 29(10): 72-79. DOI： 10.3969/j.issn.1000-0801.2013.10.013.

摘要

僵尸网络仿真是僵尸网络研究领域的一门新兴技术，近年来日益得到广泛的关注。现有研究中基于虚拟机的大规模僵尸网络实用仿真系统比较缺乏，现有系统缺乏对虚拟机集群的快速部署、多虚拟化（尤其是对轻量级虚拟化）、僵尸网络特性（如僵尸网络的昼夜随机关机开机）模拟、高可扩展性功能的支持。通过对僵尸网络仿真特性的分析，提出了一种基于虚拟机的僵尸网络仿真系统及适用于僵尸网络仿真系统的可扩展性优化技术。实验表明，所提出的基于内存性能优化和CPU性能优化的技术，可以使每个虚拟机的常驻内存比优化前减少77%以上，同一台物理机所能开启的最大虚拟机数量由15台增加到43台，当限制虚拟机的vCPU占用率到100 000时，主机CPU占用率在同样情况下能从100%降低到20%，优化效果显著。

Abstract

Botnet emulation

a new technology to investigate Botnet characteristics

gains increasing focus.The practical virtualization based Botnet emulation platform is few and lacks support of rapid deployment

multiple virtualization

specific features of the Botnet like Botnets' circadian random shutdown and starting

and high scalability which will greatly influence the Botnet propagation emulation effect.A Botnet emulation system and its scalability improvement technologies were introduced.Experiments show that the memory performance optimization and CPU performance optimization reduce more than 77% of host memory per virtual machine

the maximum virtual machines one physical machine can starts up increase from 15 to 43; the host CPU utility is deduced from 100% to 20% when the vCPU's performance is restricted to 100 000.

关键词

Keywords

references

Zhu Z S , Lu G H , Chen Y . Botnet research survey . Proceedings of the 32nd Annual IEEE International Computer Software and Applications Conference , Turku , 2008 : 967 ～ 972

Damballa G O . Botnet communication topologies:understanding the intricacies of Botnet command-and-control . http://www.technicalinfo.net/papers/BotnetCommunicationTopologies.html http://www.technicalinfo.net/papers/BotnetCommunicationTopologies.html

Kanich C , Kreibich C , Levchenko K , et al . An empirical analysis of spam marketing conversion . Proceedings of the 15th ACM Conference on Computer and Communications Security , ACM , New York,NY,USA , 2008 : 3 ～ 14

Calvet J , Davis C R , Fermandez J M , et al . The case for in-the-lab Botnet experimentation:creating and taking down a 3000-node Botnet . Proceedings of the 26th Annual Computer Security Applications Conference（ACSAC'10） , New York,NY,USA , 2010 : 141 ～ 150

Benzel T , Braden R , KIM D , et al . Testbeds and research infrastructures for the development of networks and communities . Proceedings of the 2nd International Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities , Barcelona , 2006 : 10 ～ 30

Dagon D , Gu G F , Lee C P , et al . A taxonomy of botnet structures . Proceedings of Twenty-Third Annual Computer Security Applications Conference , Seoul,Korea , 2007 : 325 ～ 339

Ruan L , Xiao L M , Zhu M F . Content addressable storage optimization for desktop virtualization based disaster backup storage system . China Communications , 2012 , 9 （ 7 ）: 1 ～ 13

Jackson A W , Lapsley D , Jones C , et al . SLINGbot:a system for live investigation of next generation botnets . Proceedings of IEEE Conference for Homeland Security,Cybersecurity Applications and Technology , Washington,DC,USA , 2009 : 313 ～ 318

Ruan L , Wang H X , Xiao L M , et al . Memory virtualization for MIPS processor based cloud server . Advances in Grid and Pervasive Computing , 2012 （ 7296 ）: 54 ～ 63

蔺波 . 基于虚拟机的僵尸网络仿真平台的研究与实现 . 北京航空航天大学硕士学位论文， 2012

Views

406

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Virtual machine placement algorithm based on cuckoo search

Performance optimization solutions for NFV data plane

Exploration and thinking of container technology for telecom operators

Design and implementation of OpenStack cloud platform for different storage modes

Scalable geometric routing scheme based on location-independent names

Related Author

Haitao LIN

Donghan JIANG

Yukai HUANG

Jinkun GENG

Ruilin LING

Dan LI

Gang LU

Xinzhang YANG

Related Institution

Beijing University of Posts and Telecommunications

China Unicom Research Institute

⁰