SSH匿名流量网站指纹攻击方法  

Website Fingerprinting Attack Method Against SSH Anonymous Traffic

作　　者：王凯 陈立云 李昊鹏 WANG Kai;CHEN Liyun;LI Haopeng(Equipment Simulation and Training Centre, Army Engineering University, Shijiazhuang 050003, China;Unit 32151 of PLA, China)

机构地区：[1]陆军工程大学装备模拟训练中心,石家庄050003 [2]中国人民解放军32151部队

出　　处：《计算机工程与应用》2019年第21期99-103,109,共6页Computer Engineering and Applications

基　　金：国家自然科学基金（No.51377170,No.61271152）;国家青年科学基金（No.61602505）

摘　　要：SSH匿名通信系统是保护信息安全和用户隐私的一种有效手段,但SSH匿名通信也有可能被用于网络犯罪活动,针对SSH匿名通信被滥用难以监管的问题,提出一种基于一维卷积神经网络的SSH匿名流量网站指纹攻击方法。该方法将特征工程与预测分类步骤整合,避免了传统指纹攻击方法中的特征提取、选择与组合的手工过程,将下行网络流按字节转换为相应数值并归一化,然后使用深度一维卷积神经网络提取高维流量指纹特征并预测分类,通过实验对100个网站目标进行指纹攻击,准确率达到92.03%,表明该方法能够对SSH匿名通信进行有效指纹攻击。SSH anonymous communication system is an effective means to protect information security and user’s privacy, but SSH anonymous communication may also be used for cybercrime activities. For the problem of SSH anonymous communication system being abuse is difficult to supervise, a website fingerprinting attack method against SSH anonymous traffic based on one-dimensional convolution neural network is proposed. The method integrates the feature engineering and the classification prediction step, and avoids the manual process of feature extraction, selection and combination in the traditional fingerprinting attack method. The method converts the downlink network stream into corresponding numeric values and normalizes them, then extracts the high-dimensional trafficfingerprint features and predicts the classification using the depth one-dimensional convolutional neural network. Through the experiment, using fingerprinting attack on 100 website targets, the accuracy rate reaches 92.03% and it indicates that the method can effectively attack the SSH anonymous communication.

关 键 词：网站指纹攻击 匿名通信 流量分析 卷积神经网络 SSH协议 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]