采用多流联合质心熵的网络流水印检测方法  

Detecting Network Watermark Through Multi-flow Joint Entropy of Centroid

作　　者：李乾坤 刘光杰[1] 刘伟伟[1] 戴跃伟[1,2] 

机构地区：[1]南京理工大学自动化学院,南京210094 [2]江苏科技大学电子信息学院,江苏镇江212003

出　　处：《小型微型计算机系统》2017年第11期2443-2447,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(61472188;61602247)资助;江苏省自然科学基金项目(BK20150472;BK20160840)资助;国家科技支撑计划项目(2014BAH41B01)资助;中央高校基本科研业务费专项项目(30920140121006;30915012208)资助

摘　　要：随着跳板主机和匿名网络成为隐匿通信关系的常用手段,网络攻击流量的溯源和定位难度日益增大.网络流水印技术在网络隐私安全领域已逐渐成为了一种重要的网络流量追踪和定位手段,设计良好的网络流水印具有强大的鲁棒性和隐蔽性,使得对网络流水印的存在性检测变得异常困难,而对流水印实施有效检测是进一步实现水印移除或水印流量复制的前提.本文提出了一种基于多流联合质心熵的水印盲检测方法,其可以实现针对当前典型的时隙质心类流水印的有效检测.在实际SSH流量上的实验结果表明,所提方法在单密钥情形下可达到与当前普遍采用的多流攻击相近的检测效果,在随机多密钥情形下多流攻击方案失效而本文方案依然可以实现高效检测.stepping-stone host and anonymous network are commonly used to hide communication relationships in recent years,it is increasingly hard to trace and locate the source of the traffic. Network watermark has gradually been an important tool to trace and locate network flow in the area of network security and privacy. Well-designed network watermark can have a strong feature of robustness and invisibility,which makes it hard for effective existence detection,however,effective detection is the precondition of the further implementation of the watermark removal or the watermark flow replication. We proposed a new blind detection method based on multiflow joint entropy of centroid through taking both multi-flow correlation and transformation of centroid distribution into consideration which can accomplish the effective detection of centroid-based network watermark with random secret keys. Experimental results show that our approach has an equal efficiency compared with common used multi-flow attack method on real-world SSH flows when faced with watermark using same secret keys,moreover,in the case of random keys multi-flow attack scheme failed but our scheme can still achieve highly effective detection.

关 键 词：流量溯源 流水印 匿名网络 跳板主机 多流攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]