针对BitTorrent协议中Piece消息的隐写分析方法  

STEGANOGRAPHIC ANALYSIS OF PIECE MESSAGE IN BITTORRENT PROTOCOL

作　　者：邢俊俊 翟江涛[1] 刘伟伟[2] Xing Junjun;Zhai Jiangtao;Liu Weiwei(School of Electronic and Information,Jiangsu University of Science and Technology,Zhenjiang 212003,Jiangsu,China;School of Automation,Nanjing University of Science and Technology,Nanjing 210000,Jiangsu,China)

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003 [2]南京理工大学自动化学院,江苏南京210000

出　　处：《计算机应用与软件》2020年第5期315-320,共6页Computer Applications and Software

基　　金：国家自然科学基金项目(61702235,61472188,61602247,U1636117);江苏省自然科学基金项目(BK20150472,BK20160840)。

摘　　要：网络隐写是当前网络攻击中常见的一种隐蔽通信方式,给网络安全造成了极大隐患。BitTorrent网络作为一种使用极为广泛的协议,拥有巨大流量,是隐藏信息的极佳载体。近来,有研究者提出了一种基于Piece消息的网络隐写方法,公开文献中尚无有效的检测算法。针对此,提出一种基于多特征分类的检测方法。提取正常和含密Piece消息数据流;提取网络数据流时间序列的均值、方差与信息熵特征;使用SVM分类器给出检测结果。实验结果显示,在观测窗口为1000个数据包时,该方法对基于Piece消息隐写的检测率可达94.7%。Network steganography is a common way of covert transmission of information in current network attacks,which brings great hidden dangers to network information security.As a widely used protocol,BitTorrent network is an ideal carrier for information hiding with huge data traffic.Recently,researchers have proposed a network steganography method based on the Piece message.There is no effective detection algorithm in the open literature at present.This paper presents a detection method based on multi-feature classification.It extracted normal and encrypted Piece message data streams,and extracted the mean value,variance and information entropy characteristics of the time series of network data streams.Finally,the test results were given based on the SVM classifier.Experimental results show that when the observation window reaches 1000 packets,the detection rate of the method based on Piece message steganography can reach 95%.

关 键 词：BITTORRENT网络 Piece消息 隐写检测 多特征 SVM分类器 信息安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]