Tor匿名通信流量在线识别方法  

Online Identification of Tor Anonymous Communication Traffic

作　　者：何高峰[1] 杨明[1] 罗军舟[1] 张璐[1] 

机构地区：[1]东南大学计算机科学与工程学院,江苏南京211189

出　　处：《软件学报》2013年第3期540-556,共17页Journal of Software

基　　金：国家重点基础研究发展计划(973)(2010CB328104);国家自然科学基金(61272054;61202449;61070161;61003257;60903162);国家科技支撑计划(2010BAI88B03;2011BAK21B02);国家核高基科技重大专项(软件类)项目(2010ZX01044-001-001);高等学校博士点专项科研基金(20110092130002);江苏省自然科学基金(BK2008030);江苏省网络与信息安全重点实验室资助项目(BM2003201);教育部计算机网络与信息集成重点实验室(东南大学)资助项目(93K-9)

摘　　要：匿名通信技术的滥用给网络监管带来了新的挑战.有效识别出匿名通信流量,是阻止该类技术滥用的前提,具有重要的研究意义和应用价值.现有研究工作侧重于匿名通信关系的确认,无法用于匿名通信流量的识别和阻塞.针对这个问题,围绕广泛使用的Tor匿名通信系统,深入分析运行机制,归纳总结其流量特征.在此基础上,分别提出基于TLS指纹和基于报文长度分布的Tor匿名通信流量识别方法.对两种识别方法的优缺点和适用性进行了详细分析和讨论,并通过CAIDA数据集和在线部署对识别方法进行了验证.实验结果表明,基于TLS指纹和基于报文长度分布的识别方法均能有效识别出Tor匿名通信流量.Abuse of anonymous communication systems has introduced new challenges into network administration. The effective identification of anonymous communication traffic is a prerequisite to prevent such abuse; thus, this is fundamentally important for both theoretical researches and practical applications. Existing researches mainly focus on the confirmation of anonymous communication relationship and cannot be used to identify and block anonymous communication traffic. To solve this problem, the operation mechanism is deeply analyzed and traffic characteristics are summarized for the widely used Tor anonymous communication system. On this basis, a TLS fingerprint-based and packet-size distributions based methods are proposed to identify Tor anonymous communication traffic, respectively. The advantages, disadvantages and applicability of these two methods are analyzed and discussed in detail, and are validated by CAIDA dataset and online deployment. Experimental results prove that both methods are effective in identifying Tot anonymous communication traffic.

关 键 词：匿名通信 TOR 流量识别 TLS指纹 报文长度分布 

分 类 号：TP391.4[自动化与计算机技术—计算机应用技术]