远程主机网络指纹模型研究  

Study of remote computer network fingerprint model

作　　者：唐彰国[1] 李焕洲[1] 钟明全[1] 张健[1] 

机构地区：[1]四川师范大学网络与通信技术研究所,四川成都610066

出　　处：《计算机工程与设计》2011年第8期2592-2595,2607,共5页Computer Engineering and Design

基　　金：四川省应用基础研究基金项目(07JY029-011);四川省教育厅基金项目(08ZA043)

摘　　要：为了识别和区分互联网上的不同机器,给出了网络指纹模型的定义和性质并进行了形式化描述,在分析主机IP地址、MAC地址等传统网络标识方法可靠性不足的基础上,利用硬件设备时钟漂移等计算机特征信息,研究并设计了一种基于数据融合的远程主机指纹探测和识别原型系统,有效解决了远程主机由于环境变更导致指纹漂移所带来的误报问题。实验结果表明,该模型在子网主机数量识别、远程计算机跟踪等网络安全领域较传统方法有着更高的准确性和可靠性。To identify and distinguish between different machines on the Internet, the definition and property of network fingerprint model is proposed and the formal description is given. To overcome shortcomings of the traditional network identification method such as host IP address and MAC address, based on the characteristic computer information such as clock drift of hardware device, a kind of detection and identification prototype system ofrerrfote network computer fingerprinting is designed based on data fusion. The problem posed by false positives caused by the remote host fingerprint drift due to environmental changes is effectively solved. Experimental results indicate that the model has higher accuracy and reliability than the traditional method in the network security areas such as subnet host number identification, remote computer tracing and so on.

关 键 词：远程主机 网络指纹 时钟漂移 数据融合 网络安全 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]