基于校正熵的网络行为隐蔽信道的检测算法  

Study on the detection algorithm of covert network behavior channel based on corrected entropy

作　　者：钱玉文[1] 宋华菊[2] 赵邦信[1] 张彤芳[1] 郝劲松[1] 

机构地区：[1]南京理工大学电子工程与光电技术学院,江苏南京210094 [2]南京晓庄学院,江苏南京210011

出　　处：《系统工程与电子技术》2013年第6期1312-1317,共6页Systems Engineering and Electronics

基　　金：国家自然科学基金(61271230)资助课题

摘　　要：为解决传统检测方法检测隐蔽行为信道检测率较低的问题,提出了基于校正熵的隐蔽行为信道检测算法。所提算法利用向用户操作序列中嵌入隐蔽信息后,必然会引起其条件熵变化的原理进行检测。校正熵的引入,有效克服了利用条件熵进行检测会产生误报问题。基于校正熵对行为信道进行检测实验,检测结果表明,基于校正熵的隐蔽行为信道检测算法能够较好地在有噪声的环境中检测出几种常见的隐蔽时间信道,检测率约为96%。To solve the problem that traditional covert channel detection algorithms cannot detect covert beha- vior channel precisely, a detection approach based on corrected entropy is proposed. The idea of detection approach is that when embedding the information into network operations of the users, the condition entropy of some features of network operations would be changed. In order to solve the problem of false alarm of the detector based on comdition entropy, the detection approach based on corrected entopy is proposed. Several experiments are done to detect several covert behavior channels to get the performance of the detection algorithm based on corrected entropy. The detection results show that the algorithm can work well in detecting several covert behavior chan nels and the detection rate is about 96%.

关 键 词：网络安全 隐写 隐蔽信道 熵 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]