HTTPS网页流量的指纹提取和识别技术研究

发布时间：2018-09-03 18:11

【摘要】：随着网络通讯技术的发展,为了有效能够保障用户个人隐私问题和数据传输安全,加密流量被广泛应用到了网络传输中。对于网页通讯,越来越多的Web站点也选择使用HTTPS协议来进行网页数据的传输。然而,许多不法分子利用了HTTPS协议的特性,在HTTPS网页中传播有害信息。为了能够有效地对HTTPS流量进行管理,需要采用一种方法对目标HTTPS网页建立指纹库,完成对未知HTTPS流量的指纹识别。本文在确立了两种可以作为HTTPS网页指纹信息的特征值后,首先实现了一套网页指纹信息采集系统,可以对目标网页进行实时的指纹库构建。系统通过主动访问目标HTTPS网页,同时采用旁路监听的方式进行网页流量捕获,从而采集网页的指纹信息。然后,研究了基于C4.5决策树算法的网页指纹识别方法对于HTTPS网页的识别效果,分别在只包含目标网页和包含背景流量的数据集上进行实验,并对实验结果进行了分析。在取得了上述实验结果基础上,本文又提出了一种基于网页对象特征的网页指纹识别算法,并实现了该算法的基础模型。鉴于实际网络环境中存在大量网页混合流量,本文分别研究了该算法对单个目标网页、多个目标网页以及加入背景流量后的网页指纹识别效果。最后,对上述两种指纹识别方法进行了对比和分析,阐述了其各自存在的优缺点以及方法本身适应的网路环境。结果表明,基于网页对象特征的网页指纹识别算法在识别含有多个目标网页的混合流上具有较高的可行度,且背景流的加入并不会影响到算法的正常运作。
[Abstract]:With the development of network communication technology, encryption traffic has been widely used in network transmission in order to effectively protect the personal privacy of users and the security of data transmission. For web communication, more and more Web sites also choose to use HTTPS protocol to transmit web data. However, many criminals take advantage of the HTTPS protocol to spread harmful information on HTTPS pages. In order to manage the HTTPS traffic effectively, a method is needed to establish the fingerprint database of the target HTTPS web page, and to complete the fingerprint identification of the unknown HTTPS traffic. After establishing two kinds of characteristic values which can be used as the fingerprint information of HTTPS pages, this paper first implements a set of fingerprint information collection system, which can construct the fingerprint database of the target web pages in real time. The system accesses the target HTTPS web page actively, and acquires the fingerprint information of the web page by the way of bypass monitoring. Then, the paper studies the effect of fingerprint recognition method based on C4.5 decision tree algorithm on HTTPS pages. Experiments are carried out on the data sets containing only target pages and background traffic, and the experimental results are analyzed. Based on the above experimental results, a fingerprint recognition algorithm based on web object features is proposed, and the basic model of the algorithm is implemented. In view of the large amount of web pages mixed traffic in the actual network environment, this paper studies the fingerprint recognition effect of the algorithm for single target web page, multiple target pages and web pages with background traffic respectively. Finally, the two fingerprint identification methods mentioned above are compared and analyzed. The advantages and disadvantages of the two methods and the suitable network environment are described. The results show that the fingerprint recognition algorithm based on web object features has a high feasibility in identifying mixed flows with multiple target pages, and the addition of background flow will not affect the normal operation of the algorithm.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.092

【相似文献】