基于流量预处理的新型流关联技术的研究

发布时间：2018-11-22 19:20

【摘要】：互联网给人们日常生活带来方便的同时,其安全问题亦在日益增多。无论是在匿名通信追踪还是跳板入侵检测中,流身份鉴别都是一个很重要的问题。常用的网络流水印技术虽然能够有效地对数据流来源进行确认追踪,但其很难同时实现较强的鲁棒性和隐蔽性。例如,在基于时间间隔的网络流水印方法中,检测者在转发或者记录各类流量特征后,会通过缩小或者扩大相邻数据包间的时延来完成水印的嵌入过程。由于此类方法在每个时隙Qg引入的时间延迟较小,所以水印的隐蔽性较好。不过,一旦网络流在传输过程中出现丢包、包重组、虚假数据包注入等干扰现象时,使用此类方法可能会导致水印的自同步化失效,进而无法恢复嵌入的特殊信号,故流水印的鲁棒性较弱。本课题的研究目标是在不需要转发和扰乱流量模式的前提下,设计兼具鲁棒性和适应性的流标识符,以便准确、高效地进行网络流的关联匹配。总体而言,本研究致力于为传统流量分析技术与经典信息理论、密码学原理的结合,提供一个可能有趣的视角。一方面,借助Takens定理探寻隐藏在流量模式中的混沌特性,并以此获取一个以Huffman编码为基础的流标识符;另一方面,巧用网络流固有的突发性和混沌特性,选取独特而顽健的流量特征,并以此为基础构建一个基于Shamir(t,n)门限秘密共享机制的流标识符。实验结果显示,与现存的比较重要的方法相比,本文所提方案在时延抖动、分组恶意丢弃、虚假数据包注入等网络干扰下,仍然具备较好的检测性能。
[Abstract]:While the Internet brings convenience to people's daily life, its security problems are increasing day by day. Stream authentication is an important problem in anonymous communication tracking and springboard intrusion detection. Although the commonly used network pipeline printing technology can effectively identify and track the source of data flow, it is difficult to achieve strong robustness and concealment at the same time. For example, in the network pipelining method based on time interval, after forwarding or recording all kinds of traffic characteristics, the watermark embedding process is completed by reducing or enlarging the delay between adjacent packets. Because the time delay introduced by this method in each slot Qg is relatively small, the watermark has better concealment. However, once packet loss, packet recombination and false packet injection occur in the network flow, the self-synchronization of the watermark may be invalidated, and the embedded special signal can not be recovered. Therefore, the robustness of stream watermarking is weak. The research goal of this paper is to design both robust and adaptive flow identifiers without forwarding and disturbing traffic patterns in order to accurately and efficiently match network flows. In general, this study aims to provide a potentially interesting perspective for the combination of traditional traffic analysis techniques with classical information theory and cryptographic principles. On the one hand, the chaos characteristic hidden in traffic mode is explored by Takens theorem, and a stream identifier based on Huffman coding is obtained. On the other hand, a stream identifier based on Shamir (TCN) threshold secret sharing mechanism is constructed on the basis of selecting unique and robust traffic characteristics by using the inherent sudden and chaotic characteristics of network flow. The experimental results show that the proposed scheme still has better detection performance under the network interference such as delay jitter packet malicious drop false packet injection and so on compared with the existing more important methods.
【学位授予单位】：华侨大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】