一种针对BitTorrent协议中have消息的隐写分析方法

Steganalysis method for have message in BitTorrent protocol

网络隐写是一种以计算机网络通信数据为载体的隐蔽通信技术。BitTorrent协议的巨大流量使其成为一种极佳的隐写载体,基于BitTorrent协议have消息的隐写即在此背景下提出,目前公开文献尚无有效的检测算法。基于此,提出了一种基于多特征分类的检测方法。该方法首先提取正常have消息数据流,接着提取均值、方差与直方图特征,最后基于AdaBoost分类器给出了检测结果。实验结果表明,所提方法在观测窗口达到1 000个数据包时对该隐写的识别正确率可达96%,在检测基于have消息的隐写时具有良好效果。

Network steganography is a kind of computer network communication data as the carrier of the hidden communication technology.BitTorrent protocol of the huge flow makes it an excellent steganographic carrier,based on BitTorrent protocol it proposed the steganography of have message in this context,there is no effective detection algorithm in current public literature.Based on this,this paper presented a multi-feature classification based on the detection method.Firstly,it extracted the method from the normal data stream,then it generated the secret data according to the concealed method,and then extracted the normal data and the dense data.Finally,it gave the detection result based on the AdaBoost classifier.The experimental results show that the accuracy of the proposed method can reach 96%when the observation window reaches 1 000 packets,it has good effect in detecting steganography based on have messages.