摘要
随着跳板主机和匿名网络成为隐匿通信关系的常用手段,网络攻击流量的溯源和定位难度日益增大.网络流水印技术在网络隐私安全领域已逐渐成为了一种重要的网络流量追踪和定位手段,设计良好的网络流水印具有强大的鲁棒性和隐蔽性,使得对网络流水印的存在性检测变得异常困难,而对流水印实施有效检测是进一步实现水印移除或水印流量复制的前提.本文提出了一种基于多流联合质心熵的水印盲检测方法,其可以实现针对当前典型的时隙质心类流水印的有效检测.在实际SSH流量上的实验结果表明,所提方法在单密钥情形下可达到与当前普遍采用的多流攻击相近的检测效果,在随机多密钥情形下多流攻击方案失效而本文方案依然可以实现高效检测.
stepping-stone host and anonymous network are commonly used to hide communication relationships in recent years,it is increasingly hard to trace and locate the source of the traffic. Network watermark has gradually been an important tool to trace and locate network flow in the area of network security and privacy. Well-designed network watermark can have a strong feature of robustness and invisibility,which makes it hard for effective existence detection,however,effective detection is the precondition of the further implementation of the watermark removal or the watermark flow replication. We proposed a new blind detection method based on multiflow joint entropy of centroid through taking both multi-flow correlation and transformation of centroid distribution into consideration which can accomplish the effective detection of centroid-based network watermark with random secret keys. Experimental results show that our approach has an equal efficiency compared with common used multi-flow attack method on real-world SSH flows when faced with watermark using same secret keys,moreover,in the case of random keys multi-flow attack scheme failed but our scheme can still achieve highly effective detection.
出处
《小型微型计算机系统》
CSCD
北大核心
2017年第11期2443-2447,共5页
Journal of Chinese Computer Systems
基金
国家自然科学基金项目(61472188
61602247)资助
江苏省自然科学基金项目(BK20150472
BK20160840)资助
国家科技支撑计划项目(2014BAH41B01)资助
中央高校基本科研业务费专项项目(30920140121006
30915012208)资助
关键词
流量溯源
流水印
匿名网络
跳板主机
多流攻击
flow tracing
network watermark
anonymous network
stepping-stone host
multi-flow attack
