主动网络流水印技术研究进展  

Progress in research on active network flow watermark

作　　者：郭晓军[1,2,3] 程光[1,3] 朱琛刚[1,3] TRUONG Dinh-Tu 周爱平[1,3] 

机构地区：[1]东南大学计算机科学与工程学院,江苏南京210096 [2]西藏民族学院信息工程学院,陕西咸阳712082 [3]东南大学计算机网络和信息集成教育部重点实验室,江苏南京210096

出　　处：《通信学报》2014年第7期178-192,共15页Journal on Communications

基　　金：江苏省科技支撑计划(工业)基金资助项目(BE2011173);江苏省未来网络前瞻性基金资助项目(BY2013095-5-03);江苏省六大人才高峰基金资助项目(2011-DZ024);国家重点基础研究发展计划("973"计划)基金资助项目(2009CB320505);国家自然科学基金资助项目(60973123)~~

摘　　要：在匿名网络环境下通信双方关系确认、僵尸网络控制者追踪、中间跳板主机发现等方面,以被动网络流量分析(passive traffic analysis)为核心的传统入侵检测与流关联技术存在空间开销大、实时性差、识别率低、灵活性欠佳、难以应对加密流量等明显缺点。而将主动网络流量分析与数字水印思想相融合的主动网络流水印(ANFW,active network flow watermark)技术能有效克服传统被动网络流量分析方法的不足,已引起了国内外学者的广泛关注。首先阐述了ANFW机制的通用模型,总结了ANFW技术的分类及所涉及的角色关系;其次,详细综述了近年来提出的多种典型的基于不同网络流特征的ANFW技术,并进行对比性总结;最后,概述了当前ANFW技术自身安全威胁及应对措施现状,展望了其未来的研究方向。In face of confirming user communication relationship in anonymous network, tracing botmaster and detecting stepping stones, traditional intrusion detection and flow correlation methods which mainly rely on passive traffic analysis have shown many drawbacks obviously, such as high space costs, poor real-time, low accuracy, poor flexibility, fail in dealing with encrypted traffic and so on. However, the active network flow watermark（ANFW） which combined the idea of digital watermarking and active traffic analysis can overcome the drawbacks above effectively. ANFW has aroused extensive attention of scholars at home and abroad. Firstly, the general model of ANFW is presented, and the classification of existing proposals and roles involved in ANFW are summarized. Then, several representative ANFW approaches using distinct network flow characteristics are presented and compared in detail. Finally, threats against existing ANFW technology and their corresponding countermeasures are overviewed, also some future research directions about ANFW are discussed.

关 键 词：网络安全 主动流量分析 网络流水印 流特征 匿名通信 跳板节点 僵尸网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]