暗网信息相比于表网往往具有更强时新性,可用于威胁情报获取和研究.针对安全研究人员难以从海量暗网数据中迅速获取强时新性威胁情报的问题,提出一种基于暗网的威胁情报主动获取框架.框架包括暗网数据获取、数据筛选和威胁情报获取3个模...暗网信息相比于表网往往具有更强时新性,可用于威胁情报获取和研究.针对安全研究人员难以从海量暗网数据中迅速获取强时新性威胁情报的问题,提出一种基于暗网的威胁情报主动获取框架.框架包括暗网数据获取、数据筛选和威胁情报获取3个模块,针对暗网中的“恶意软件”、“黑客工具”和“数据泄露”3类信息,提出并使用信息量计算方法I@n(information at n),利用暗网和表网信息出现的时间差,计算暗网信息在表网中的信息量.通过表网中的信息量与信息的时新性之间的规律,主动获取暗网中的强时新性威胁情报.实验表明,通过该框架可以从暗网中获取威胁情报,帮助安全分析人员及时应对未知网络威胁.展开更多
The anonymity of the darknet makes it attractive to secure communication lines from censorship.The analysis,monitoring,and categorization of Internet network traffic are essential for detecting darknet traffic that ca...The anonymity of the darknet makes it attractive to secure communication lines from censorship.The analysis,monitoring,and categorization of Internet network traffic are essential for detecting darknet traffic that can generate a comprehensive characterization of dangerous users and assist in tracing malicious activities and reducing cybercrime.Furthermore,classifying darknet traffic is essential for real-time applications such as the timely monitoring of malware before attacks occur.This paper presents a two-stage deep network chain for detecting and classifying darknet traffic.In the first stage,anonymized darknet traffic,including VPN and Tor traffic related to hidden services provided by darknets,is detected.In the second stage,traffic related to VPNs and Tor services is classified based on their respective applications.The methodology of this paper was verified on a benchmark dataset containing VPN and Tor traffic.It achieved an accuracy of 96.8%and 94.4%in the detection and classification stages,respectively.Optimization and parameter tuning were performed in both stages to achieve more accurate results,enabling practitioners to combat alleged malicious activities and further detect such activities after outbreaks.In the classification stage,it was observed that the misclassifications were due to the audio and video streaming commonly used in shared real-time protocols.However,in cases where it is desired to distinguish between such activities accurately,the presented deep chain classifier can accommodate additional classifiers.Furthermore,additional classifiers could be added to the chain to categorize specific activities of interest further.展开更多
文摘暗网信息相比于表网往往具有更强时新性,可用于威胁情报获取和研究.针对安全研究人员难以从海量暗网数据中迅速获取强时新性威胁情报的问题,提出一种基于暗网的威胁情报主动获取框架.框架包括暗网数据获取、数据筛选和威胁情报获取3个模块,针对暗网中的“恶意软件”、“黑客工具”和“数据泄露”3类信息,提出并使用信息量计算方法I@n(information at n),利用暗网和表网信息出现的时间差,计算暗网信息在表网中的信息量.通过表网中的信息量与信息的时新性之间的规律,主动获取暗网中的强时新性威胁情报.实验表明,通过该框架可以从暗网中获取威胁情报,帮助安全分析人员及时应对未知网络威胁.
文摘The anonymity of the darknet makes it attractive to secure communication lines from censorship.The analysis,monitoring,and categorization of Internet network traffic are essential for detecting darknet traffic that can generate a comprehensive characterization of dangerous users and assist in tracing malicious activities and reducing cybercrime.Furthermore,classifying darknet traffic is essential for real-time applications such as the timely monitoring of malware before attacks occur.This paper presents a two-stage deep network chain for detecting and classifying darknet traffic.In the first stage,anonymized darknet traffic,including VPN and Tor traffic related to hidden services provided by darknets,is detected.In the second stage,traffic related to VPNs and Tor services is classified based on their respective applications.The methodology of this paper was verified on a benchmark dataset containing VPN and Tor traffic.It achieved an accuracy of 96.8%and 94.4%in the detection and classification stages,respectively.Optimization and parameter tuning were performed in both stages to achieve more accurate results,enabling practitioners to combat alleged malicious activities and further detect such activities after outbreaks.In the classification stage,it was observed that the misclassifications were due to the audio and video streaming commonly used in shared real-time protocols.However,in cases where it is desired to distinguish between such activities accurately,the presented deep chain classifier can accommodate additional classifiers.Furthermore,additional classifiers could be added to the chain to categorize specific activities of interest further.
