HMM特征提取结合感知哈希匹配的网络时间隐蔽信道检测

HMM Feature Extraction Combined with Perceptual Hash Matching for Network Time Covert Channel Detection

针对传统网络隐蔽信道检测识别率低和鲁棒性差的问题,利用正常信道和隐蔽信道在网络流量时间序列特性的差异,提出一种隐马尔科夫链(HMM)和感知哈希匹配的网络隐蔽信道检测方法。实验表明:所提方法能准确检测隐蔽信道的网络流量,且整体区分水平在70%~85%之间;在信号噪声干扰下能够保持较高的识别率,具有较好的鲁棒性;所提方法在感知特征提取花费的时间要明显少于传统的频谱域感知特征提取,且复杂度低。

Aiming at the problems of low recognition rate and poor robustness of traditional network covert channel detection,a network covert channel detection method based on hidden Markov chain and perceptual Hash matching is proposed by using the difference between normal channel and covert channel in network traffic time series characteristics.Experiments show that the proposed method can accurately detect the network traffic of covert channels,and the overall discrimination level is between 70%~85%.Under the interference of signal noise,it can maintain high recognition rate and has good robustness.The proposed method takes less time than traditional spectral domain sensing feature extraction,and the complexity is low.