基于时隙的多重冗余流指纹模型

刘科显; 关建峰; 张婉澂; 何志凯; 闫迪嘉

doi:10.11959/j.issn.2096-109x.2023006

您当前的位置：

首页 >

文章列表页 >

基于时隙的多重冗余流指纹模型

学术论文 | 更新时间：2024-06-03

- 基于时隙的多重冗余流指纹模型
- Multiple redundant flow fingerprint model based on time slots
- 网络与信息安全学报 2023年9卷第1期页码：115-129
- 作者机构：
  
  1. 北京邮电大学计算机学院（国家示范性软件学院），北京 100876
  2. 中国航空综合技术研究所，北京 100028
  3. 北京工业大学信息学部，北京 100124
- 作者简介：
  
  [ "刘科显（1996- ），男，河南周口人，北京邮电大学博士生，主要研究方向为网络安全" ]
  [ "关建峰（1982- ），男，河南巩义人，北京邮电大学副教授、博士生导师，主要研究方向为网络架构、区块链与网络安全、移动互联网、大数据与人工智能" ]
  [ "张婉澂（1995- ），女，安徽芜湖人，北京邮电大学硕士生，主要研究方向为内生网络安全" ]
  [ "何志凯（1986- ），男，安徽蚌埠人，中国航空综合技术研究所高级工程师，主要研究方向为无人系统标准化与可用性" ]
  [ "闫迪嘉（2000- ），男，北京人，主要研究方向为网络安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2018YFE0206800)
- DOI：10.11959/j.issn.2096-109x.2023006
  中图分类号： TP393
- 网络首发：2023-02，
  
  纸质出版：2023-02-25
- 稿件说明：
移动端阅览
刘科显, 关建峰, 张婉澂, 等. 基于时隙的多重冗余流指纹模型[J]. 网络与信息安全学报, 2023,9(1):115-129.

Kexian LIU, Jianfeng GUAN, Wancheng ZHANG, et al. Multiple redundant flow fingerprint model based on time slots[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 115-129.
刘科显, 关建峰, 张婉澂, 等. 基于时隙的多重冗余流指纹模型[J]. 网络与信息安全学报, 2023,9(1):115-129. DOI： 10.11959/j.issn.2096-109x.2023006.

Kexian LIU, Jianfeng GUAN, Wancheng ZHANG, et al. Multiple redundant flow fingerprint model based on time slots[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 115-129. DOI： 10.11959/j.issn.2096-109x.2023006.

摘要

随着互联网的日益广泛应用，各种网络安全问题频频暴露，以“打补丁”形式为主的安全增强模式难以有效防范日益增长的安全风险，网络安全领域研究者认为未来互联网体系架构应当将安全作为一种基本属性，实现网络架构对安全的内生支持。为了支持内生安全的数据可信，在流水印/流指纹机制的研究基础之上，设计实现了一种基于时隙的多重冗余流指纹模型。该模型使用3个时隙间隔，通过对指定时隙内的数据包进行延迟等操作，可在相邻比特操作不产生冲突的情况下实现指纹嵌入，并且引入冗余编码来提高指纹健壮性，同时考虑到网络中抖动或攻击者的恶意扰乱等行为，将延迟干扰、垃圾数据包干扰以及丢包干扰对模型的影响进行了理论分析，结果表明在给定网络流中数据的包分布时，随着冗余位的增加，指纹模型的鲁棒性明显提高。为了减少时间和空间消耗，提高数据包操作的效率和精度，基于内核设计和实现流指纹原型系统，并对其效率和鲁棒性进行评估，实验表明该模型具有很高的鲁棒性。最后，展示了所提模型的应用场景，基于该流指纹功能模型，能有效检测中间人攻击，预防网络身份欺骗。

Abstract

With the increasingly widespread use of the Internet

various network security problems are frequently exposed

while the “patching” style security enhancement mechanisms cannot effectively prevent the growing security risks.The researchers in the field of network security believe that the future Internet architecture should take security as a basic attribute to provide the native security support which is also called as endogenous safety and security.In order to support the data trustworthiness of endogenous security

a time-slot based multiple redundant flow fingerprint model was designed and implemented based on the research of the watermark (or fingerprint) mechanism.The proposed model used only three time slot intervals and operated the packets within the specified time slots

so that the fingerprint can be embedded without conflicting with the adjacent bit operations.Redundant coding was introduced to improve the fingerprint robustness

and the behaviors such as jitter or malicious disruptions by attackers in the network were considered.Furthermore

the impacts of delayed interference

spam packet interference and packet loss interference were analyzed.The analytical results show that the robustness of the fingerprint model improves with increasing redundant bits when the packet distribution in the network stream is given.Besides

in order to reduce the consumption of time and space and improve the efficiency and accuracy of packet operations

a flow fingerprinting prototype system was designed and implemented based on the kernel

and its efficiency and robustness were evaluated.The experimental result show that the model has high robustness.Additionally

the application scenario of the model was elaborated

which can effectively detect man-in-the-middle attacks and prevent network identity spoofing with the help of the flow fingerprinting model.

关键词

Keywords

references

邬江兴 . 网络空间拟态防御研究 [J ] . 信息安全学报 , 2016 , 1 ( 4 ): 1 - 10 .

WU J X . Research on cyber mimic defense [J ] . Journal of Cyber Security , 2016 , 1 ( 4 ): 1 - 10 .

WANG X , REEVES D S , WU S F , et al . Sleepy watermark tracing:An active network-based intrusion response framework [C ] // IFIP International Information Security Conference . 2001 : 369 - 384 .

YU W , FU X , GRAHAM S , et al . DSSS-based flow marking technique for invisible traceback [C ] // 2007 IEEE Symposium on Security and Privacy (SP'07) . 2007 : 18 - 32 .

JIA W , TSO F P , LING Z , et al . Blind detection of spread spectrum flow watermarks [J ] . Security and Communication Networks , 2013 , 6 ( 3 ): 257 - 274 .

HUANG J , PAN X , FU X , et al . Long PN code based DSSS watermarking [C ] // Proceedings IEEE INFOCOM . 2011 : 2426 - 2434 .

ZHANG L , WANG Z , WANG Q , et al . MSAC and multi-flow attacks resistant spread spectrum watermarks for network flows [C ] // 2nd IEEE International Conference on Information and Financial Engineering . 2010 : 438 - 441 .

XU X , ZHANG L , YAN J . PN code diversification based spread spectrum flow watermarking technology [C ] // 14th International Conference on Computational Intelligence and Security (CIS) . 2018 : 254 - 258 .

WANG X , REEVES D S , WU S F . Inter-packet delay based correlation for tracing encrypted connections through stepping stones [C ] // European Symposium on Research in Computer Security . 2002 : 244 - 263 .

WANG X , REEVES D S . Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays [C ] // Proceedings of the 10th ACM Conference on Computer and Communications Security . 2003 : 20 - 29 .

HOUMANSADR A , KIYAVASH N , BORISOV N . Rainbow:A robust and invisible non-blind watermark for network flows [C ] // NDSS . 2009 : 406 - 422 .

HOUMANSADR A , BORISOV N . The need for flow fingerprints to link correlated network flows [C ] // International Symposium on Privacy Enhancing Technologies Symposium . 2013 : 205 - 224 .

SOLTANI R , GOECKEL D , TOWSLEY D , et al . Fundamental limits of invisible flow fingerprinting [J ] . IEEE Transactions on Information Forensics and Security , 2019 , 15 : 345 - 360 .

REZAEI F , HOUMANSADR A . FINN:fingerprinting network flows using neural networks [C ] // Annual Computer Security Applications Conference . 2021 : 1011 - 1024 .

IACOVAZZI A , SARDA S , ELOVICI Y . Inflow:Inverse network flow watermarking for detecting hidden servers [C ] // IEEE INFOCOM 2018-IEEE Conference on Computer Communications . 2018 : 747 - 755 .

IACOVAZZI A , SARDA S , FRASSINELLI D , et al . DropWat:An invisible network flow watermark for data exfiltration traceback [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 13 ( 5 ): 1139 - 1154 .

YAO Z , ZHANG L , GE J , et al . An invisible flow watermarking for traffic tracking:A hidden markov model approach [C ] // IEEE International Conference on Communications . 2019 : 1 - 6 .

PYUN Y J , PARK Y H , WANG X , et al . Tracing traffic through intermediate hosts that repacketize flows [C ] // IEEE INFOCOM 2007-26th IEEE International Conference on Computer Communications . 2007 : 634 - 642 .

HOUMANSADR A , BORISOV N . SWIRL:A scalable watermark to detect correlated network flows [C ] // NDSS . 2011 .

MO L , LYU G , WANG B , et al . The design and implementation of an efficient quaternary network flow watermark technology [C ] // 17th International Conference on Mobility,Sensing and Networking (MSN) . 2021 : 746 - 751 .

REZAEI F , HOUMANSADR A . TagIt:Tagging network flows using blind fingerprints [J ] . Proc Pri Enhancing Technol , 2017 , 2017 ( 4 ): 290 - 307 .

罗跃斌 . 网络主动防御关键技术研究 [D ] . 长沙：国防科学技术大学 , 2017 .

LUO Y B . Research on key technologies of network active de fense [D ] . Changsha:National University of Defense Technology , 2017 .

LIU W , LIU G , XIA Y , et al . Using insider swapping of time intervals to perform highly invisible network flow watermarking [J ] . Security and Communication Networks,2018 , 2018 .

WANG X , CHEN S , JAJODIA S . Network flow watermarking attack on low-latency anonymous communication systems [C ] // 2007 IEEE Symposium on Security and Privacy (SP'07) . 2007 : 116 - 130 .

ZHANG L , LUO J , YANG M . An improved DSSS-based flow marking technique for anonymous communication traceback [C ] // Symposia and Workshops on Ubiquitous,Autonomic and Trusted Computing . 2009 : 563 - 567 .

HOU J , LI Q , TAN R , et al . An intrusion tracking watermarking scheme [J ] . IEEE Access , 2019 , 7 : 141438 - 141455 .

WANG X , LUO J , YANG M . An interval centroid based spread spectrum watermark for tracing multiple network flows [C ] // IEEE International Conference on Systems,Man and Cybernetics . 2009 : 4000 - 4006 .

WANG X , LUO J , YANG M . A double interval centroid-based watermark for network flow traceback [C ] // The 14th International Conference on Computer Supported Cooperative Work in Design . 2010 : 146 - 151 .

LIU Y , GHOSAL D , ARMKNECHT F , et al . Robust and undetectable steganographic timing channels for IID traffic [C ] // International Workshop on Information Hiding . 2010 : 193 - 207 .

浏览量

350

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据