基于游程检测与快速傅里叶变换的加密比特流识别

Identification of Encrypted Bit Stream Based on Runs Test and Fast Fourier Transform

为获得链路层中的加密与未加密比特流样本,首先提出了基于游程检测方法的链路层加密比特流识别方案,解决了未知网络环境下的加密与未加密比特流样本获取问题。同时,采用快速傅里叶变换分别对加密与未加密比特流样本进行处理,根据最大差异原则确定了快速傅里叶变换结果的特征点位置,并基于正态分布原理确定了特征点的取值,建立了特征模板。最后,以某无线网络链路层加密比特流为识别对象,对提出的方案的有效性进行了验证。结果表明,该方案对链路层加密与未加密比特流的识别率均可达到95%以上。

To obtain samples of encrypted data and plaintext in data link layer,an encrypted data identification scheme was provided based on the run test,meanwhile,and the fast Fourier transform was used to process the encrypted data and plaintext.Based on the principle of maximum difference,the characteristic point of the result of the fast Fourier transform was determined.Then the value of the characteristic point and the feature template were determined using the principle of normal distribution.Finally,the identification rate of the proposed scheme was verified,taking a wireless network data as the identification object.The experimental results demonstrate that the rate of the proposed scheme achieves 95％ both for the encrypted data and the plaintext.