采用多流联合质心熵的网络流水印检测方法

Detecting Network Watermark Through Multi-flow Joint Entropy of Centroid

随着跳板主机和匿名网络成为隐匿通信关系的常用手段,网络攻击流量的溯源和定位难度日益增大.网络流水印技术在网络隐私安全领域已逐渐成为了一种重要的网络流量追踪和定位手段,设计良好的网络流水印具有强大的鲁棒性和隐蔽性,使得对网络流水印的存在性检测变得异常困难,而对流水印实施有效检测是进一步实现水印移除或水印流量复制的前提.本文提出了一种基于多流联合质心熵的水印盲检测方法,其可以实现针对当前典型的时隙质心类流水印的有效检测.在实际SSH流量上的实验结果表明,所提方法在单密钥情形下可达到与当前普遍采用的多流攻击相近的检测效果,在随机多密钥情形下多流攻击方案失效而本文方案依然可以实现高效检测.

stepping-stone host and anonymous network are commonly used to hide communication relationships in recent years,it is increasingly hard to trace and locate the source of the traffic. Network watermark has gradually been an important tool to trace and locate network flow in the area of network security and privacy. Well-designed network watermark can have a strong feature of robustness and invisibility,which makes it hard for effective existence detection,however,effective detection is the precondition of the further implementation of the watermark removal or the watermark flow replication. We proposed a new blind detection method based on multiflow joint entropy of centroid through taking both multi-flow correlation and transformation of centroid distribution into consideration which can accomplish the effective detection of centroid-based network watermark with random secret keys. Experimental results show that our approach has an equal efficiency compared with common used multi-flow attack method on real-world SSH flows when faced with watermark using same secret keys,moreover,in the case of random keys multi-flow attack scheme failed but our scheme can still achieve highly effective detection.