基于多维正交载体的可裂解流指纹方案

doi:10.11959/j.issn.1000-436x.2015064

摘要/Abstract

摘要：

针对流交换中流源身份不可知、流交换范围不可控和流路径不可追踪问题，提出了基于多维正交载体的可裂解流指纹方案。利用2种相互正交的载体提高指纹信息的容量，并通过时间间隔重心载体特性和基于隐马尔科夫模型的解码技术实现可裂解性，提高方案的健壮性。分析了基于重心属性值随机选取载体的反制多流攻击能力，以及不同条件下指纹重心标记算法和基于隐马尔科夫模型解码技术的正确率。最后通过实验对算法的健壮性和隐蔽性进行了探讨。

关键词: 流交换, 多维正交载体, 可裂解性, 指纹重心, 指纹字段

Abstract:

Aimed at problems of unknown source identity, uncontrollable net-flow exchange and untraceable flow- ex-changing paths, it proposes cracking-resistance net-flow fingerprint scheme based on multi-dimensional orthogonal carri-ers. It uses two mutually orthogonal carriers so as to improve the capacity of fingerprint information. It achieves crack-ing-resistance by interval centroid carrier characteristics and hidden Markov model based decoding technique. Ultimately, it improves the robustness of scheme. What's more, it analyzes the resistance of multi-flow attack ability by using cen-troid attribute value to select embedding carriers randomly. Besides, it analyzes accuracy of fingerprint centroid algorithm and quantization index modulation decoding technique based on HMM under different cases. Finally, its invisibility and robustness is evaluated by experiments.

Key words: net-flow exchange, multi-dimensional orthogonal carrier, cracking resistance, fingerprint centroid, finger-print field

雷程,张红旗,孙奕,杜学绘. 基于多维正交载体的可裂解流指纹方案[J]. 通信学报, 2015, 36(3): 104-114.

Cheng LEI,Hong-qi ZHANG,Yi SUN,Xue-hui DU. Cracking-resistance net-flow fingerprint scheme based on multi-dimensional orthogonal carriers[J]. Journal on Communications, 2015, 36(3): 104-114.

图/表 14

图1

图2

表1

图3

图4

表2

图5

图6

表3

图7

表4

表5

表6

表7

参考文献 27

[1]	ZHU Z , LU G , CHEN Y , et al. Botnet research survey[A]. Computer Software and Applications, 32nd Annual IEEE International[C]. 2008.967-972.
[2]	ZHANG Y Z , XIAO JUN , YUN X C , et al. DDoS attack detection and control methods[J]. Journal of Software, 2012,23(8):2058-2072.
[3]	SCHUBA C L , KRSUL I V , KUHN M G , et al. Analysis of a denial of service attack on TCP[A]. 1997 IEEE Symposium on Security and Privacy[C]. 1997.208-223.
[4]	HOUMANSADR A , BORISOV N . The need for flow fingerprints to link correlated network Flows[A]. Privacy Enhancing Technologies[C]. Springer Berlin Heidelberg, 2013.205-224.
[5]	PYUN Y J , PARK Y H , WANG X , et al. Tracing traffic through inter-mediate hosts that repacketize flows[A]. 26th IEEE International Con-ference on Computer Communications[C]. 2007.634-642.
[6]	PYUN Y J , PARK Y , REEVES D S , et al. Interval-based flow water-marking for tracing interactive traffic[J]. Computer Networks, 2012,56(5):1646-1665.
[5]	WANG X , CHEN S , JAJODIA S . Network flow watermarking attack on low-latency anonymous communication systems[A] IEEE Symposium on Security and Privacy[C] 2007.116-130.
[8]	KIYAVASH N , HOUMANSADR A , BORISOV N . Multiflow attacks against network flow watermarking schemes[A]. Proceedings of 17th USENIX Security[C]. San Jose, 2008.307-320.
[9]	YU W , FU X , GRAHAM S , et al. DSSS-based flow marking tech-nique for invisible traceback[A]. IEEE Symposium on Security and Privacy[C]. 2007.18-32.
[10]	JIA W , TSO F P , LING Z , et al. Blind detection of spread spectrum flow watermarks[J]. Security and Communication Networks, 2013,6(3):257-274.
[11]	HUANG J , PAN X , Fu X , et al. Long PN code based DSSS water-marking[A]. 2011 INFOCOM, Proceedings IEEE[C]. 2011.2426-2434.
[12]	HOUMANSADR A , KIYAVASH N , BORISOV N . Multiflow attack resistant watermarks for network flows[A]. Proceedings of IEEE International Conference on Acoustic, Speech, and Processing[C]. 2009.1497-1500.
[13]	王振兴，张连成，郭毅等．基于水印信息重排序的多流攻击反制方法[J]．应用科学学报， 2013,31(3):278-284. WANG Z X , ZHANG L C , GUO Y , et al. Multi-flow attack resistance based on reordering of watermark bits[J]. Journal of Applied Sciences, 2013,31(3):278-284.
[14]	HOUMANSADR A , KIYAVASH N , BORISOV N . Rainbow: a robust and invisible non-blind watermark for network flows[A]. Inndss[C]. 2009.
[15]	WANG X , REEVES D S . Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays[A]. Proceedings of the 10th ACM conference on Computer and Communications Security[C].ACM, 2003.20-29.
[16]	CHEN B , WORNELL G W . Quantization index modulation: a class of provably good methods for digital watermarking and information em-bedding[J]. IEEE Transactions on Information Theory, 2001,47(4):1423-1443.
[17]	RABINER L R . A tutorial on hidden Markov models and selected applications in speech recognition[J]. Proceedings of the IEEE, 1989,77(2):257-286.
[18]	EDDY S R . Hidden markov models[J]. Current opinion in structural biology, 1996,6(3):361-365.
[19]	MINTZER F , BRAUDAWAY G W . If one watermark is good, are more better[A]. IEEE International Conference on Acoustics, Speech, and Signal Processing[C]. 1999.2067-2069.
[20]	KIYAVASH N , HOUMANSADR A , BORISOV N . Multi-Flow attacks against network flow watermarks: analysis and countermeasures[J]. arXiv preprint arXiv:1203.1390, 2012.
[21]	MATTHEW C , DAVEY , DAVID et al. Reliable communication over channels with insertions, deletions, and substitutions[J]. IEEE Transactions on Information Theory, 2001,47:687-698.
[22]	BAVIER A C , BOWMAN M , CHUN B N , et al. Operating systems support for planetary-scale network services[A]. NSDI[C]. 2004.19-19.
[23]	ELTOFT T , KIM T , LEE T W , et al. On the multivariate Laplace distribution[J]. Signal Processing Letters,IEEE, 2006,13(5):300-303.
[24]	HAZEWINKEL M . Normal distribution[J]. Encyclopedia of Mathematics, 2001,13(6):337-342.
[25]	GRIMALDI R P . Discrete and Combinatorial Mathematics: An Applied Introduction 5th ed[M]. Massachusetts: Addison Wesley, 2003.
[26]	DONOHO D L , FLESIA A G , SHANKAR U , et al. Multiscale step-ping-stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay[A]. Recent Advances in Intrusion Detection[C]. Springer Berlin Heidelberg, 2002.17-35.
[27]	MASSEY JR F J . The Kolmogorov-Smirnov test for goodness of fit[J]. Journal of the American statistical Association, 1951,46(253):68-78.

系统参数	秘密参数
时间间隔长度T	指纹重心属性值C_FP
最大时延a (0＜a＜T)	秘钥K_S
量子化乘数q	—
间隔数目s()	—

参数名称	参数值
量化步长Δ	60 ms
最大时延a	700 ms
稀疏因子n	8
间隔数目s	240
量子化乘数q	1.25

T/s	正确率/%
3	62.1
6	79.6
9	92.8
12	100.0

T/s	K-S距离
3	0.012 4
6	0.013 0
9	0.011 6
12	0.010 4