Research And Implementation Of ZeroNet Darknet Content Analysis And Identification Traceback Technology

Anonymous communication system has been further developed with the enhancement of Internet communication security and privacy protection.This technology can encrypt the content of communication and the identity of the communicator,and it also brings a lot of illegal information.As a result,a large number of illegal activities form the darknet.Illegal activities affect the network environment and people's privacy and security,we need to strengthen effective supervision using technical measures.At present,there have been many researches on popular anonymous communication systems such as Tor,I2 P etc.There are few studies on the emerging ZeroNet darknet,so it is particularly important to carry out the content analysis and the identification and traceback on the ZeroNet darknet.To address these issues,this thesis studies the content analysis and the identification and traceback technology of ZeroNet darknet.First,we obtain the address and content of the ZeroNet site,extract features based on the bag of words model and the TF-IDF method,statistically classify the site text content,and implement ZeroNet darknet content analysis technology.Then,we implement ZeroNet traffic identification technology by analyzing the ZeroNet communication protocol.Finally,we implement traffic trackback technology for the ZeroNet darknet with Tor turned on.We analyze the impact of flow rate on the trackback according to the TCP sliding window mechanism,and analyze the minimum deployment cost of the trackback technology according to the Tor bandwidth weighted circuit selection algorithm to implement the ZeroNet darknet trackback technology.The research details mainly include the following aspects:(1)We study the ZeroNet content analysis technology.First,we analyze the methods of acquiring ZeroNet site addresses,including the identification and acquisition of site addresses.Then,on the basis of obtaining the address of sites,we use bag of word model and the TF-IDF method to extract features,and train the machine learning classifier to implement content classification.Finally,we verify the model generalization ability through experiments,and the prediction accuracy of the SVM classifier in the test set reaches 93.2%.(2)We study the ZeroNet identification and trackback technology.First,we study the ZeroNet communication protocol,complete the ZeroNet traffic identification by analyzing the communication between the peer node and the Tracker,and the communication between the peers.Then,we analyze the trackback technology for the ZeroNet darknet with Tor turned on,adjust the flow rate according to the adjustable range of the advertised TCP window size,and embed the signal into the flow.Finally,we verify the effects of the trackback technology.When the ratio of window size to original window size is between 0.5 and 0.8,the detection rate is up to 94.2%,and the false positive rate is less than 0.5%.(3)We study the effectiveness analysis of trackback deployment costs.For the ZeroNet darknet with Tor turned on,we first analyze the Tor bandwidth weighted circuit selection algorithm,and propose the onion router selection strategy and AS selection strategy.Then on this basis,we propose the optimal dynamic programming algorithm,polynomial time algorithm and nonlinear optimization problem solution,and calculate the minimum deployment cost required to control traffic.Finally,we conduct tracking effectiveness experiments.The results show that deploying switches near 562 ASes can monitor 99.9% of traffic.(4)Combining the above research results,we design and implement the content analysis and the identification and traceback system of ZeroNet darknet.The system implements six modules,content acquisition module and content classification module are used for ZeroNet content analysis technology,traffic modulation and demodulation module and effectiveness analysis module are used for ZeroNet identification and trackback technology.On this basis,the data of ZeroNet darknet are stored in the storage module,and the experimental results of the data are displayed with the visualization module.In summary,this thesis studies ZeroNet content analysis technology,identification and trackback technology and effectiveness analysis method of trackback technology.On this basis,we design and implement the content analysis and the identification and traceback system of ZeroNet darknet,which can provide effective technical support in ZeroNet darknet supervision.