摘要
随着互联网技术的发展和进步,不论是在实际生活中还是在工业信息系统中,网络语音电话(Voice over Internet Protocol,VoIP)以其成本低廉、稳定、方便快捷的特点逐渐取代了传统手机通话,被广泛使用。VoIP语音电话在带来稳定快捷的同时,也带来许多安全问题。VoIP的广泛性使得其十分适合作为嵌入隐蔽信道的良好递质。但是由于多数VoIP语音电话的通信协议都是闭源的,对VoIP协议的分析就成为了一切应用的基础。本文研究了如何分析闭源VoIP流量特征并进行建模,以及如何通过特征模型进行应用。具体来说,以QQ和微信语音电话为例,我们提出了通过对VoIP语音数据包的长度分布特征以及数据位特征进行特征分析,建立了长度特征模型以及数据位特征模型,并且通过两个特征模型得到了可利用的数据包伪造格式,并在QQ和微信VoIP流中成功嵌入了隐蔽信道。实验结果表明,利用我们的分析方法可以很好地对闭源VoIP语音流量进行分析并得到特征模型,同时以此为基础在VoIP嵌入的隐蔽信道拥有良好的隐蔽性和数据带宽。
With the development and progress of Internet technology,Voice over Internet Protocol(VoIP)has gradually replaced traditional mobile phone calls with its features of low cost,stability,convenience and efficiency,and has been widely used in both real life and industrial information systems.VoIP not only brings stability and efficiency,but also brings many security problems.VoIP's universality makes it a good medium for embedding covert channels.However,because most VoIP communication protocols are closed source,the analysis of VoIP protocol becomes the basis of all applications.This paper studies how to analyze and model closed source VoIP traffic characteristics and how to apply them through feature models.Specifically,taking QQ and wechat voice calls as examples,we propose to establish length feature model and data byte feature model by analyzing length distribution feature and data byte feature of VoIP voice packets,and obtain the available packet forgery format through the two feature models.Covert channel is successfully embedded in QQ and wechat VoIP streams.The experimental results show that the closed-source VoIP voice traffic can be well analyzed and the feature models can be obtained by using our analysis method.Meanwhile,based on this,the covert channel embedded in VoIP has good concealment and data bandwidth.
作者
任浩
崔竞松
Ren Hao;Cui Jingsong(School of Cyber Science and Engineering·WHU,Wuhan Hubei,430072)
出处
《工业信息安全》
2022年第1期33-47,共15页
Industry Information Security
