Research On Host Recognition Technology Based On Network Flow

Nowadays,with the rapid development of Internet,the security issues of network are becoming more and more serious,which not only threaten the security of our privacy and property,but also challenge the authority of our country.In fact,attackers in the cyber world usually conceal their identities with various means,so it is extremely difficult to trace these criminal acts and obtain evidence.If the host can be located,it will be of great help to trace these criminal acts.Host identification has become the focus of current network security research.At present,many host identification methods are actively used to send data packets for obtaining information more or less.Host usually possesses intrusion detection mechanism.In this way,however,sending data packets is easy to be detected,which will lead to inaccurate recognition results.In addition,in the process of tracing host identifications,the complete feature information of host fingerprint is used to identify the host.What's more,with the increase of the number of fingerprints,the number of feature information increases sharply,which leads to the problem of low recognition efficiency.The paper,the research of host recognition technology based on network traffic is carried out for solving the two problems.First of all,in this paper,it is easy to be detected by the intrusion detection system for the active sending of the probe data packet,which makes it impossible to detect the real host and make the detection result inaccurate.Based on multi-dimensional host recognition,an improved method for multi-dimensional host recognition model for passive detection is proposed.This method uses purely passive methods to obtain feature information of multiple dimensions,and then extracts host fingerprints from these feature information for host identification.Using this method avoids the possibility of detection by the detection tool,and the experimental results show that the accuracy of identifying the host is not reduced.Then,for the host identification process,the problem of low efficiency is identified.This paper proposes a performance optimization method based on fingerprint reduction for host recognition model.In this method,feature selection is performed by an optimized CHI(Chi square)algorithm,and the selected feature information is used as a host fingerprint for host identification.Finally,the experiment proves that under the premise that the recognition accuracy is basically unchanged,the streamlined fingerprint has better recognition efficiency than the complete fingerprint,and the overall recognition rate is improved.