HMM特征提取结合感知哈希匹配的网络时间隐蔽信道检测  

HMM Feature Extraction Combined with Perceptual Hash Matching for Network Time Covert Channel Detection

作　　者：许正合 樊有军 杨洋 周勇科 侯天佑 XU Zhenghe;FAN Youjun;YANG Yang;ZHOU Yongke;HOU Tianyou(No.1 Gas Production Plant,PetroChina Qinghai Oilfield Company Limited,Golmud 816099,China)

机构地区：[1]中国石油天然气股份有限公司青海油田分公司,采气一厂,青海格尔木816099

出　　处：《微型电脑应用》2024年第4期120-123,共4页Microcomputer Applications

摘　　要：针对传统网络隐蔽信道检测识别率低和鲁棒性差的问题,利用正常信道和隐蔽信道在网络流量时间序列特性的差异,提出一种隐马尔科夫链(HMM)和感知哈希匹配的网络隐蔽信道检测方法。实验表明:所提方法能准确检测隐蔽信道的网络流量,且整体区分水平在70%~85%之间;在信号噪声干扰下能够保持较高的识别率,具有较好的鲁棒性;所提方法在感知特征提取花费的时间要明显少于传统的频谱域感知特征提取,且复杂度低。Aiming at the problems of low recognition rate and poor robustness of traditional network covert channel detection,a network covert channel detection method based on hidden Markov chain and perceptual Hash matching is proposed by using the difference between normal channel and covert channel in network traffic time series characteristics.Experiments show that the proposed method can accurately detect the network traffic of covert channels,and the overall discrimination level is between 70%~85%.Under the interference of signal noise,it can maintain high recognition rate and has good robustness.The proposed method takes less time than traditional spectral domain sensing feature extraction,and the complexity is low.

关 键 词：隐蔽信道检测 网络安全 隐马尔科夫链 特征提取 感知哈希匹配 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]