Research On Network Flow Tracing Algorithm Based On Perceptual Features

With the development of Internet technology,people are paying more and more attention to the issue of network security.Current security systems such as firewalls and intrusion detection generally can only detect and isolate network intrusions,and it is difficult to accurately locate the true source of network attacks.If the true address of the network attack can be traced,network intrusion can be cut off from the source to ensure information security.The tracing technology based on network flow correlation is widely concerned by researchers because it can adapt to various network environments such as springboard attacks and anonymous systems.This paper makes a detailed study of the current stream correlation technology,and proposes three solutions to the problems of poor robustness and large storage overhead of the current flow correlation.For the problem of complex association matching algorithm and large amount of computation,we propose a network flow tracing algorithm based on temporal features and perceptual hash.The algorithm extracts the difference value of flow rate at the same offset position and the time interval between the key packets in the stable time slot as the characteristics,and then uses the perceptual hash function to map different network flows into a fixed length perceptual hash sequence.The simulation results show that the algorithm not only ensure the accuracy of tracing,but also reduce the complexity of network tracing matching algorithm.In order to solve the problem of low robustness of flow correlation in a wide range of jitter,we propose a network flow tracing algorithm based on time-frequency features.The algorithm uses Short-Time Fourier Transform to map the network flow to the high-dimensional time-frequency matrix,and obtains the direction coefficient characteristics by integrating the time-frequency features matrix in multiple directions.Finally,we use the robustness of DCT to encode the direction coefficients into unique traffic identifiers.The simulation results showthat the algorithm is robust to the network flow jitter,packet loss and other disturbances.In order to solve the problem that it is difficult to synchronize the network flow captured by the sender and the receiver in the process of flow Association,we propose a network flow tracing algorithm based on the Scale Invariant Feature Transform(SIFT).In this algorithm,SIFT algorithm is used to extract the local perceptual key points in the network traffic,and then the gradient relationship between the local key points and their neighbors is used to encode the perceptual vector to realize the abstract encoding of the network traffic.The simulation results show that the algorithm can better deal with the interference of flow merging and flow segmentation.The basic idea of the above three algorithms is to get comprehensive features that are not easy to be tampered with by attackers through feature extraction or signal transformation of network traffic,and then propose corresponding matching algorithms based on these features to achieve traceability.In order to verify the effectiveness of the proposed algorithm,a simulation experiment is carried out with CAIDA data set.The experimental results show that the traceability algorithm proposed in this paper has higher accuracy and better robustness compared with the existing traceability algorithm.