【摘要】：隨著通信數(shù)據(jù)隱私保護需求的不斷增加,各種匿名通信技術(shù)也得到了快速發(fā)展,但是,在這項技術(shù)保護通信雙方個人信息的同時,也使得利用簡單數(shù)據(jù)包檢測進行的網(wǎng)絡(luò)監(jiān)管變得更加困難。Shadowsocks作為新興的匿名通信軟件,因其速度快,易部署等優(yōu)點,在國內(nèi)得到了廣泛了使用�，F(xiàn)有的匿名流量識別的研究成果大多具有很強的針對性,在流量特征提取,方法建模等軟件識別技術(shù)方面具有很強的依賴性,而shadowsocks因為使用其自身所帶的獨特協(xié)議,現(xiàn)有的方法很難對其進行識別;同時,當(dāng)前的大部分學(xué)術(shù)分析成果還停留在實驗階段,并且高速網(wǎng)絡(luò)環(huán)境下匿名流量的數(shù)據(jù)集收集與構(gòu)造、大量混合流下網(wǎng)站指紋的分割等問題仍沒有提出很好的解決辦法。因此,如何對shadowsocks流量進行建模,如何解決高速網(wǎng)絡(luò)環(huán)境下匿名流量識別,是當(dāng)前國內(nèi)網(wǎng)絡(luò)安全領(lǐng)域亟待解決的問題。本文在對以往相關(guān)研究成果進行分析的基礎(chǔ)上,針對上述問題,深入分析了shadowsocks匿名軟件的運行機制,將其運行過程和HTTP協(xié)議相結(jié)合,提出了多粒度啟發(fā)式流量識別方法和基于混合流分割的網(wǎng)站指紋識別算法。多粒度啟發(fā)式流量識別算法是從主機行為、數(shù)據(jù)流、隱藏信息等多方面檢測shadowsocks流量,達到過濾的目的。該方法可以解決因匿名流量占總數(shù)據(jù)流量比例小而導(dǎo)致數(shù)據(jù)集不平衡而帶來識別準(zhǔn)確性低的問題。基于混合流分割的網(wǎng)站指紋識別算法是在多粒度啟發(fā)式流量識別方法的基礎(chǔ)上,選擇區(qū)分度高的網(wǎng)站指紋特征,將可疑混合流進行聚類分割,解決混合流中單站點、多站點識別問題,達到降低誤報率的目的。接著,本文分析了高速網(wǎng)絡(luò)環(huán)境下匿名流量識別所面臨的難點,確定新系統(tǒng)要達到的目標(biāo),結(jié)合多粒度啟發(fā)式流量識別算法和基于混合流分割的網(wǎng)站指紋識別算法,設(shè)計并實現(xiàn)了高速網(wǎng)絡(luò)環(huán)境下shadowsocks匿名流量識別系統(tǒng),并詳細闡述了識別系統(tǒng)總體設(shè)計與詳細模塊設(shè)計。最后,本文利用多組不同的真實數(shù)據(jù)集,對多粒度啟發(fā)式流量識別算法和基于混合流分割的網(wǎng)站指紋識別算法分別進行評估,通過和現(xiàn)有的方法,以及系統(tǒng)適應(yīng)性等方面對運行結(jié)果進行分析,驗證了該算法的高準(zhǔn)確性;同時,在高速網(wǎng)絡(luò)下,針對具體的模塊設(shè)計對高速網(wǎng)絡(luò)下shadowsocks匿名流量識別系統(tǒng)進行測試,證明了該系統(tǒng)具有很高的識別準(zhǔn)確率。
[Abstract]:With the increasing demand for privacy protection of communication data, various anonymous communication technologies have been developed rapidly. However, while this technology protects the personal information of both sides of the communication, As a new anonymous communication software, Shadowsocks has been widely used in China because of its advantages of high speed and easy deployment. Most of the existing research results of anonymous traffic identification have strong pertinence, and have strong dependence on software recognition technology, such as traffic feature extraction, method modeling and so on. However, shadowsocks uses its own unique protocol. The existing methods are difficult to identify. At the same time, most of the current academic analysis results are still in the experimental stage, and the collection and construction of anonymous traffic data set in high-speed network environment, a large number of mixed flow website fingerprint segmentation and other problems have not been put forward a good solution. Therefore, how to model shadowsocks traffic and how to solve anonymous traffic identification in high-speed network environment is an urgent problem in the field of domestic network security. Based on the analysis of previous related research results, this paper analyzes the running mechanism of shadowsocks anonymous software, and combines its running process with HTTP protocol, aiming at the above problems. A multi-granularity heuristic traffic identification method and a web site fingerprint recognition algorithm based on mixed stream segmentation are proposed. Multi-granularity heuristic traffic recognition algorithm detects shadowsocks traffic from many aspects such as host behavior, data flow, hidden information and so on, to achieve the purpose of filtering. This method can solve the problem of low recognition accuracy caused by the imbalance of data set caused by the small proportion of anonymous traffic to total data traffic. The website fingerprint recognition algorithm based on mixed flow segmentation is based on the multi-granularity heuristic traffic identification method, selects the website fingerprint feature with high degree of distinction, and clusters the suspicious mixed flow to solve the problem of single site in the mixed flow. Multi-site identification problem to achieve the purpose of reducing false alarm rate. Then, this paper analyzes the difficulties faced by anonymous traffic identification in high-speed network environment, determines the objectives to be achieved by the new system, and combines multi-granularity heuristic traffic identification algorithm and website fingerprint identification algorithm based on mixed flow segmentation. The anonymous traffic identification system of shadowsocks in high-speed network environment is designed and implemented, and the overall design and detailed module design of the identification system are described in detail. Finally, this paper evaluates the multi-granularity heuristic traffic identification algorithm and the website fingerprint recognition algorithm based on mixed flow segmentation by using different sets of real data sets. The running results are analyzed from the aspects of system adaptability and so on, and the high accuracy of the algorithm is verified. At the same time, the anonymous traffic identification system of shadowsocks in high-speed network is tested according to the specific module design, which proves that the system has a high recognition accuracy.
【學(xué)位授予單位】：電子科技大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2017
【分類號】：TP393.0

【參考文獻】

相關(guān)期刊論文 前10條

1 朱亞玲;張睿敏;;基于SSH框架的用戶信息管理的設(shè)計與實現(xiàn)[J];電腦知識與技術(shù);2016年09期

2 王玉雷;李玲娟;;一種密度和劃分結(jié)合的聚類算法[J];計算機技術(shù)與發(fā)展;2015年09期

3 顧曉丹;楊明;羅軍舟;蔣平;;針對SSH匿名流量的網(wǎng)站指紋攻擊方法[J];計算機學(xué)報;2015年04期

4 龔建華;;JSON格式數(shù)據(jù)在Web開發(fā)中的應(yīng)用[J];辦公自動化;2013年20期

5 陳周國;蒲石;祝世雄;;匿名網(wǎng)絡(luò)追蹤溯源綜述[J];計算機研究與發(fā)展;2012年S2期

6 張連成;王振興;苗甫;;網(wǎng)絡(luò)流量偽裝技術(shù)研究[J];計算機應(yīng)用研究;2011年07期

7 劉鑫;王能;;匿名通信綜述[J];計算機應(yīng)用;2010年03期

8 張勇;;基于ReliefF算法的模糊聚類新算法[J];華南金融電腦;2009年01期

9 時雷;虎曉紅;席磊;;樸素貝葉斯分類算法及其應(yīng)用研究[J];光盤技術(shù);2008年11期

10 鄧蕊;馬永軍;劉堯猛;;基于改進交叉驗證算法的支持向量機多類識別[J];天津科技大學(xué)學(xué)報;2007年02期

相關(guān)博士學(xué)位論文 前1條

1 劉鑫;基于Tor網(wǎng)絡(luò)的匿名通信研究[D];華東師范大學(xué);2011年

相關(guān)碩士學(xué)位論文 前1條

1 吳家順;Website指紋識別攻擊與防護技術(shù)研究[D];南京理工大學(xué);2013年

，

本文編號：2345480