The Research Of Flow Correlation Technology Based On Features Of Network Traffic

With the rapid development of the Internet,information security issues have become more and more serious.The research of flow correlation technology is very necessary in detecting intermediate stepping stone and associated identity in the anonymous communication.To the best of our knowledge,network flow watermarking,which combines network traffic analysis and digital watermarking,can effectively track data sources.However,the existent network flow watermark methods always uncompatible in strong robustness and invisibility.Because the flow watermark needs to be ensured that it is not discovered by the attacker,but also to ensure that it can always "survive" in the network flow without being removed by the attacker.For example,although the increase of redundant data packets can improve the robustness of the watermark to some extent,it also increases the space-time overhead of watermark embedding and extraction.However,if multiple watermarks are continuously embedded,the risk of exposing the watermark will increase.In order to solve the above problems,we propose a flow correlation technology based on network traffic characteristics.Under the premise of not modifying the network traffic mode,the scheme directly analyzes the network traffic itself and designs the network flow identifier to correlate the network flows.The specific research in this paper is as follows:(1)Network traffic Correlation method based on chaos theory and principal component analysis(PCA): The main research content of this scheme is to make use of network traffic has chaotic property,that is,the time-space characteristics can not be found from the original network traffic time series.By estimating the delay time and embedding dimension,the original network traffic time series can be transformed into a regular network traffic time series,and the potential time-space characteristics of network traffic can be explored.Then,the principal component analysis method(PCA)is used to find the characteristics of the most important network traffic while maintaining the time-space characteristics.The main research content of this paper isto design the characteristics of the network flow with both robustness and adaptability to link network flows without modifying the original traffic patterns efficiently.Finally,calculate the similarity between the source and the sink,so as to accurately and efficiently perform the correlation matching of the network flow.The experimental results show that compared with the schemes RAINBOW and ICBW,our scheme has better detection efficiency under the same network interference.(2)A network flow identification scheme based on wavelet transform and Chaos Theory: the core idea of this scheme is to use wavelet transform not only have the characteristics of multi-resolution analysis,but also have the ability to characterize local features of signals in the time domain and frequency domain.The wavelet transform is used to decompose the network traffic time series,and the network traffic characteristics are described from multiple scales to obtain low frequency components and high frequency components.Then the phase space reconstruction is used to reconstruct the two components separately,and the time-space characteristics of different frequency sequences are obtained.Finally,the results are reconstructed by the inverse operation of wavelet decomposition to generate the final stream characteristic results of network traffic.Based on this,the network flow characteristics based on wavelet transform and chaos theory are constructed.The results of experiment show that the proposed approach has a high detection rate and a low false positive rate in comparison with the existing more important methods.