Research On Time-frequency Centroid Network Flow Watermarking Technology Against Anonymous Network Flow Transformation

With the rapid development of network technology,the importance of information security has become increasingly prominent.Current cyber attackers often use anonymous communication systems as a cover to carry out illegal activities.Existing IP packet marking technology and passive traffic analysis technology is unable to effectively trace the source of the malicious traffics due to its large resource consumption and poor real-time performance.Therefore,active traffic analysis technology,represented by network watermarking technology,has been paid more attention in the research of network attack tracing because of its good invisibility and stability that makes it difficult to be destroyed and forged.Due to the large number of network flow transformations in anonymous networks,it is required that the watermarking method has strong robustness.At the same time,with the development of watermark detection and attack technology,such as K-S,KLD detection and multi-flow attack,the watermarking method must have good invisibility.In view of the urgent need of the network flow watermarking scheme with well robustness and invisibility,the following research work is carried out in this dissertation:(1)Based on the thorough analysis of the network flow transformations in anonymous communication system,this paper classified the mechanisms of flow transformation into three typical cases:network delay perturbation,packet loss and chaff injection.Taken time interval centroid as a research object,the influence of the three typical anonymous network transformations on the stability of it is theoretically analyzed,which proves that the time interval centroid can be used as a stable watermark information carrier.(2)A robust watermarking method based on interval grouping is proposed.The interval centroid is used as the carrier of watermarking information,the key shared between watermark embedder and extractor is used to select the time interval group of the target flow to embedding watermark information,and the watermark sequence is generated by the centroid of the network flow,and then by actively modulating the centroid of the mark interval to complete the embedding of the watermark information.The technology taken by this method makes sure that the watermark scheme has well robustness and invisibility,and can resist the typical network flow transformations in the anonymous network and the most advanced multi-flow attack.At the same time,as the packets modulation is within a small range,the time distribution characteristic of the watermarked network flow is close to the normal network flow,which ensures the invisibility of watermark information.(3)To verify the effectiveness of the proposed method,this paper carried out a simulation experiment in detail and an experiment on actual network.In the experiments,three typical network flow transformations are applied to the watermarked network flows,which are time delay noise disturbance,packet loss perturbation and chaff injection perturbation,and then observe the influence on the detection rate.What's more,K-S and KLD calculation analysis and multi-flow attack are carried out on the watermarked network flows and normal network flows,and the influence on the time distribution characteristics is observed.The experimental results show that the proposed method is robust to anonymous network transformations and has good concealment for typical watermark detection methods.Finally,a summarization of this dissertation is given,and the future research contents on this topic are prospected.