| The most widely used anonymous communication network in the dark web is Tor,which provides a bidirectional anonymity mechanism for both visitors and hidden services to hide their identities.The research on the traceability of Tor hidden services has two meanings: on the one hand,it can discover the security loopholes of anonymous communication and promote the research on the security of anonymous communication;on the other hand,it can also be used to discover and locate illegal and criminal acts.Therefore,it is of great significance to master certain means of traceability of hidden services.Tor anonymous communication network is an overlay network built on the existing Internet and implemented based on a multi-hop routing mechanism.The message will be encrypted by multiple layers before delivery,and the delivery process needs to pass through multiple nodes and be decrypted layer by layer.Any node in the anonymous circuit cannot know the whole picture of the circuit.Tor’s bidirectional anonymity mechanism,Padding mechanism,Guard mechanism,etc.protect its anonymity,making it extremely difficult to trace.However,the traffic analysis method based on the data flow correlation still has an effect on the Tor network.Therefore,this paper traces the source of the Tor hidden service based on the active watermark attack method,in order to trace its real IP address.The main contents of this paper are as follows:(1)Aiming at the characteristics that a single node in the Tor network cannot obtain the whole picture of the communication circuit,after analyzing the advantages and disadvantages of multiple hidden service traceability scenarios,this paper constructs the traceability model framework based on collusion attack.The traceability model needs to implement a collusion attack,so this paper implants a certain number of controlled nodes into the Tor network,and develops a multi-node state detection tool to obtain node state information in time.Aiming at the difficulty in verifying the traceability results,this paper builds a traceability experimental environment by building a hidden service and binding it to a controlled guard node.This environment is not significantly different from the real environment.(2)A circuit confirmation method based on the circuit termination(DESTROY)command control cell is proposed.First,locate the logical code position of the processing circuit termination cell by analyzing the Tor source code.Then a malicious code with little impact on the original program was designed and implanted to record the circuit termination time.Compare with the time when the client sends the circuit termination command to judge whether the assumption of collusion attack is satisfied.This method is used to avoid the problem of increasing the false positive rate of traceability caused by watermark detection when the collusion hypothesis is not established.(3)A watermark method based on protocol characteristics is proposed.Based on Tor’s protocols are implemented at the application layer,and when the fixed-length cells are transmitted in the underlying network,the length of the data packets shows an aggregated distribution.This paper construct an access request of a specific size and use the inter-packet interval as the watermark information to embed the watermark which purpose is to generate packets with differentiated length.Then collect network flow data at controlled guard nodes and perform watermark detection.In addition,through the packet capture analysis,it is found that the length of Tor data packets shows an aggregated distribution.The final experimental results show that watermarking method in this paper has high detection accuracy,and the false positive rate approaches 0 with the increase of watermark length. |
