Tor网桥分发中融合物理-社交属性的女巫节点检测机制

史鑫; 郭云飞; 王亚文; 孙小丽; 梁浩

doi:10.11959/j.issn.2096-109x.2023014

您当前的位置：

首页 >

文章列表页 >

Tor网桥分发中融合物理-社交属性的女巫节点检测机制

学术论文 | 更新时间：2024-06-03

- Tor网桥分发中融合物理-社交属性的女巫节点检测机制
- Physical-social attributes integrated Sybil detection for Tor bridge distribution
- 网络与信息安全学报 2023年9卷第1期页码：103-114
- 作者机构：
- 作者简介：
  
  [ "史鑫（1995- ），男，吉林长春人，信息工程大学博士生，主要研究方向为匿名网络、隐蔽通信和博弈论" ]
  [ "郭云飞（1963- ），男，河南郑州人，信息工程大学教授、博士生导师，主要研究方向为网络空间安全、云安全和电信网安全" ]
  [ "王亚文（1990- ），男，河南郑州人，信息工程大学助理研究员，主要研究方向为拟态防御和云计算" ]
  [ "孙小丽（1992- ），女，河南南阳人，信息工程大学助理研究员，主要研究方向为信息超材料、隐蔽通信和毫米波" ]
  [ "梁浩（1987- ），男，河南郑州人，信息工程大学副研究员，主要研究方向为网络空间安全和主动防御技术" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB1006200);国家重点研发计划;The National Key R＆D Program of China(2021YFB1006201);国家自然科学基金;The National Natural Science Foundation of China(62072467);国家自然科学基金;The National Natural Science Foundation of China(62002383)
- DOI：10.11959/j.issn.2096-109x.2023014
  中图分类号： TP393
- 网络首发：2023-02，
  
  纸质出版：2023-02-25
- 稿件说明：
移动端阅览
史鑫, 郭云飞, 王亚文, 等. Tor网桥分发中融合物理-社交属性的女巫节点检测机制[J]. 网络与信息安全学报, 2023,9(1):103-114.

Xin SHI, Yunfei GUO, Yawen WANG, et al. Physical-social attributes integrated Sybil detection for Tor bridge distribution[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 103-114.
史鑫, 郭云飞, 王亚文, 等. Tor网桥分发中融合物理-社交属性的女巫节点检测机制[J]. 网络与信息安全学报, 2023,9(1):103-114. DOI： 10.11959/j.issn.2096-109x.2023014.

Xin SHI, Yunfei GUO, Yawen WANG, et al. Physical-social attributes integrated Sybil detection for Tor bridge distribution[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 103-114. DOI： 10.11959/j.issn.2096-109x.2023014.

摘要

作为目前应用范围最广的网络审查规避系统之一，Tor 在网桥分发过程中面临着严重的女巫攻击威胁。具有丰富网络和人力资源的审查者往往会部署大量女巫节点，它们通过伪装成正常节点来获取网桥信息并将其封锁或屏蔽。在此过程中，由于女巫节点和正常节点身份、目的和意图的不同，在网络活动中会产生个体或群体行为差异，称为节点行为特征。针对上述女巫攻击威胁，在分析节点行为特征的基础上提出了融合物理-社交属性的女巫节点检测机制。设计了节点物理域和社交域属性评估方法。采用客观反映节点上网桥正常运行状态的节点积分值和体现网桥屏蔽情况的节点风险指数来评估节点的物理域属性；用描述节点静态属性标签的社交相似度和刻画节点动态交互行为特征的社交信任度来评估节点的社交域属性。进而，融合节点的物理域和社交域属性定义可信度指标，表征当前节点为女巫节点的可能性，并以此为指导推测节点的真实身份，实现对女巫节点的精准检测。基于构建的Tor网络运行情况模拟器和MicroblogPCU数据集对所提机制的检测性能进行仿真实验。结果表明，所提机制能够有效提高女巫节点识别率，降低误检率，对于审查者的迷惑行为具有更强抵御能力，并且在节点社交属性缺失情况下仍具有良好检测性能。

Abstract

As one of the most widely utilized censorship circumvention systems

Tor faces serious Sybil attacks in bridge distribution.Censors with rich network and human resources usually deploy a large number of Sybils

which disguise themselves as normal nodes to obtain bridges information and block them.In the process

due to the different identities

purposes and intentions of Sybils and normal nodes

individual or group behavior differences occur in network activities

called as node behavior characteristics.To handle the Sybil attacks threat

a Sybil detection mechanism integrating physical-social attributes was proposed based on the analysis of node behavior characteristics.The physical-social attributes evaluation methods were designed.The credit value of nodes objectively reflecting the operation status of bridges on the nodes and the suspicion index of nodes reflecting the blocking status of bridges

were utilized to evaluate the physical attributes of nodes.The social attributes of nodes were evaluated by the social similarity

which described the static attribute labels of nodes and their social trust characterizing the dynamic interaction behaviors of nodes.Furthermore

integrating the physical-social attributes

the credibility of nodes were defined as the possibility of the current node being a Sybil

which was exploited as a guidance on inferring the true identifies of nodes

so as to achieve accurate detection on Sybils.The detection performance of the proposed mechanism based on the constructed Tor network operation status simulator and the Microblog PCU dataset were simulated.The results show that the proposed mechanism can effectively improve the true positive rate on Sybils

and decrease the false positive rate.It also has stronger resistance on the deceptive behavior of censors

and still performs well in the absence of node social attributes.

关键词

Keywords

references

DOUGLAS F E . Circumvention of censorship of internet access and publication [D ] . University of Illinois at Urbana-Champaign , 2017 .

FIFIELD D . Threat modeling and circumvention of internet censorship [D ] . University of California Berkeley , 2017 .

LEBERKNIGHT C S , CHIANG M , WONG F M F . A taxonomy of censors and anti-censors part II:Anti-censorship technologies [J ] . International Journal of E-Politics (IJEP) , 2012 , 3 ( 4 ): 20 - 35 .

TSCHANTZ M C , AFROZ S , PAXSON V . Sok:towards grounding censorship circumvention in empiricism [C ] // IEEE Symposium on Security and Privacy . 2016 : 914 - 933 .

NOBORI D , SHINJO Y . VPN gate:a volunteer-organized public vpn relay system with blocking resistance for bypassing government censorship firewalls [C ] // 11th USENIX Symposium on Networked Systems Design and Implementation . 2014 : 229 - 241 .

ZOLFAGHARI H , HOUMANSADR A . Practical censorship evasion leveraging content delivery networks [C ] // ACM SIGSAC Conference on Computer and Communications Security . 2016 : 1715 - 1726 .

NASR M , ZOLFAGHARI H , HOUMANSADR A . The waterfall of liberty:Decoy routing circumvention that resists routing attacks [C ] // ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2037 - 2052 .

WANG Q , LIN Z , BORISOV N , et al . rBridge:user reputation based tor bridge distribution with privacy preservation [C ] // Network and Distributed Systems Security Symposium . 2013 .

杨云 , 李凌燕 , 魏庆征 . 匿名网络Tor与I2P的比较研究 [J ] . 网络与信息安全学报 , 2019 , 5 ( 1 ): 66 - 77 .

YANG Y , LI L Y , WEI Q Z . Comparative study of anonymous network Tor and I2P [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 1 ): 66 - 77 .

PORTAL T M . The Tor project [EB ] .

王啸 , 方滨兴 , 刘培朋 , 等 . Tor匿名通信网络节点家族的测量与分析 [J ] . 通信学报 , 2015 , 36 ( 2 ): 84 - 91 .

WANG X , FANG B X , LIU P M , et al . Measuring and analyzing node families in the Tor anonymous communication network [J ] . Journal on Communications , 2015 , 36 ( 2 ): 84 - 91 .

罗军舟 , 杨明 , 凌振 , 等 . 匿名通信与暗网研究综述 [J ] . 计算机研究与发展 , 2019 , 56 ( 1 ): 103 - 130 .

LUO J Z , YANG M , LING Z , et al . Anonymous communication and darknet:a survey [J ] . Journal of Computer Research and Development , 2019 56 ( 1 ): 103 - 130 .

杜捷 , 何永忠 , 杜晔 . 基于改进IPD质心的Tor网络流水印检测方法 [J ] . 网络与信息安全学报 , 2019 , 5 ( 4 ): 91 - 98 .

DU J , HE Y Z , DU Y . Improved method of Tor network flow watermarks based on IPD interval [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 4 ): 91 - 98 .

WINTER P , LINDSKOG S . How the great firewall of China is blocking Tor [C ] // USENIX Workshop on Free and Open Communications on the Internet (FOCI) . Bellevue,USA , 2012 .

MAHDIAN M , . Fighting censorship with algorithms [C ] // Internet Conference on Fun with Algorithms . 2010 : 296 - 306 .

ZAMANI M , SAIA J , CRANDALL J . TorBricks:blocking- resistant Tor bridge distribution [C ] // International Symposium on Stabilization,Safety,and Security of Distributed Systems . 2017 : 426 - 440 .

MCCOY D , MORALES J A , LEVCHENKO K . Proximax:A measurement based system for proxies dissemination [J ] . Financial Cryptography and Data Security , 2011 , 5 ( 9 ): 1 - 10 .

DOUGLAS F , PAN W , CAESAR M . Salmon:robust proxy distribution for censorship circumvention [J ] . Proceedings on Privacy Enhancing Technologies , 2016 ,( 4 ): 4 - 20 .

NASR M , FARHANG S , HOUMANSADR A , et al . Enemy at the gateways:Censorship-resilient proxy distribution using game theory [C ] // Network and Distributed Systems Security Symposium . 2019 .

GE K , HE Y . Detection of sybil attack on Tor resource distribution [C ] // IEEE International Conference on Power,Intelligent Computing and Systems . 2020 : 328 - 332 .

SANATINIA A , NOUBIR G . Honey onions:a framework for characterizing and identifying misbehaving tor HSDirs [C ] // 2016 IEEE Conference on Communications and Network Security (CNS) . 2016 : 127 - 135 .

康恺 , 张颖君 , 连一峰 , 等 . 一种社交网络 Sybil 用户检测方法 [J ] . 计算机科学 , 2016 , 43 ( 1 ): 172 - 177 .

KANG K , YANG Y J , LIAN Y F , et al . Compound approach for sybil users detection in social networks [J ] . Computer Science , 2016 , 43 ( 1 ): 328 - 332 .

吴大鹏 , 司书山 , 闫俊杰 , 等 . 基于行为特征分析的社交网络女巫节点检测机制 [J ] . 电子与信息学报 , 2017 , 39 ( 9 ): 2089 - 2096 .

WU D P , SI S S , YAN J J , et al . Behaviors analysis based sybil detection in social networks [J ] . Journal of Electronics and Information Technology , 2017 , 39 ( 9 ): 2089 - 2096 .

方晓汾 , 方凯 , 汪小东 , 等 . 基于能耗信任值的无线传感器网络Sybil 攻击检测方法研究 [J ] . 传感技术学报 , 2020 , 33 ( 6 ): 907 - 915 .

FANG F X , FANG K , WANG X D , et al . Sybil attack detection method based on energy consumption trust value in WSN [J ] . Chinese Journal of Sensors and Actuators , 2020 , 33 ( 6 ): 907 - 915 .

WU D , SI S , WANG H , et al . Social influence aware sybil detection in social networks [C ] // 2017 IEEE/CIC International Conference on Communications in China (ICCC) . 2017 : 1 - 4 .

GEDDES J , SCHUCHARD M , HOPPER N . Cover your acks:Pitfalls of covert channel censorship circumvention [C ] // ACM SIGSAC Conference on Computer ＆ Communications Security . 2013 : 361 - 372 .

MOHAJERI MOGHADDAM H , LI B , DERAKHSHANI M , et al . Skypemorph:protocol obfuscation for Tor bridges [C ] // ACM Conference on Computer and Communications Security . 2012 : 97 - 108 .

SMITS R , JAIN D , PIDCOCK S , et al . BridgeSPA:improving tor bridges with single packet authorization [C ] // Proceedings of the 10th Annual ACM Workshop on Privacy in the Electronic Society . 2011 : 93 - 102 .

WU D , ZHOU L , CAI Y . Social-aware rate based content sharing mode selection for D2D content sharing scenarios [J ] . IEEE Transactions on Multimedia , 2017 , 19 ( 11 ): 2571 - 2582 .

LIU Z , LIU Y , WINTER P , et al . TorPolice:Towards enforcing service-defined access policies for anonymous communication in the Tor network [C ] // 2017 IEEE 25th International Conference on Network Protocols (ICNP) . 2017 : 1 - 10 .

SYVERSON P , DINGLEDINE R , MATHEWSON N . Tor:The second generation onion router [C ] // Usenix Security . 2004 : 303 - 320 .

XU G , ZHOU D , LIU J . Social network spam detection based on ALBERT and combination of Bi-LSTM with self-attention [J ] . Security and Communication Networks , 2021 .

浏览量

108

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据