基于SimHash算法的主机网络嗅探攻击自主检测方法  

Autonomous detection method of host network sniffing attack based on SimHash algorithm

作　　者：何珏[1] 常安[1] 孙萌[1] 黄怀霖 HE Jue;CHANG An;SUN Meng;HUANG Huailin(China Southern Power Grid EHV Transmission Company,Guangzhou 510700,China)

机构地区：[1]中国南方电网超高压输电公司,广东广州510700

出　　处：《电子设计工程》2023年第13期79-82,88,共5页Electronic Design Engineering

摘　　要：目前提出的主机网络嗅探攻击自主检测方法转发包数据过高,导致嗅探攻击成本过低,难以在短时间内实现嗅探攻击检测。为了解决上述问题,以SimHash算法作为检测核心,提出了一种新的主机网络嗅探攻击自主检测方法。嗅探器在捕获主机网络系统内通信信息时,利用通信链路的特点和算法,建立三个约束条件用于选择最佳通信链路的最佳路径,通过路径剔除确定主机内非法信息的通信路径,确保嗅探器获取通信链路信息的真实性。计算比特流向量序列,检测数据错误包,通过数据信息的切割提高嗅探攻击成本,实现了主机网络嗅探攻击自主检测。实验结果表明,基于SimHash算法的主机网络嗅探攻击自主检测方法能够提高嗅探攻击成本,在短时间内实现主机网络嗅探攻击自主检测。The currently proposed method for autonomous detection of host network sniffing attacks forwards packets too high,resulting in low cost of sniffing attacks,and it is difficult to detect sniffing attacks in a short period of time.In order to solve the above problems,a new autonomous detection method for host network sniffing attacks is proposed with SimHash algorithm as the detection core.When the sniffer captures the communication information in the host network system,it uses the characteristics and algorithms of the communication link to establish three constraints for selecting the best path of the best communication link,and determines the illegal information in the host through path elimination.The communication path ensures the authenticity of the communication link information obtained by the sniffer.Calculate the bitstream vector sequence,detect data error packets,increase the cost of sniffing attacks by cutting data information,and realize autonomous detection of host network sniffing attacks.Experimental results show that the autonomous detection method of host network sniffing attacks based on SimHash algorithm can increase the cost of sniffing attacks and realize autonomous detection of host network sniffing attacks in a short time.

关 键 词：SimHash算法 主机网络 嗅探攻击 自主检测 

分 类 号：TN99[电子电信—信号与信息处理]