Ensemble Learning-Based Detection Techniques Of Covert Communications In Voice-Over-IP Streams

While the covert communication technology based on the Vo ice-over-IP(Vo IP)streams brings high security,it also brings some immeasurable harm.Therefore,we need to study its countermeasures-covert communication detection technology.Judging from the current research status,most of the existing covert communication detection me thods are dedicated,that is,most of the existing covert communication detection methods are based on the premise that the embedding rate,the embedding method and the embedding domain are known.However,due to the uncertainty of the embedding rate,the complexity of the embedding method and the diversity of the embedding domain,these are unknown in the actual scene.Therefore,in order to solve these problems,this thesis proposes a detection scheme for the Vo IP streams with unknown embedding rate,a detection method for Vo IP streams with unknown embedding methods,and a detection method for Vo IP streams with unknown embedding domains.The specific research is as follows:First,for the detection of Vo IP streams with unknown embedding rate,the existing detection methods based on DST evidence theory have the phenomenon of data mismatch.Based on this problem,by analyzing the data characteristics of the Vo IP streams with unknown embedding rates,this thesis proposes a novel covert communication detection scheme.The scheme first uses the K-means clustering algorithm to achieve pre-classification,which is to divide the speech samples with different embedding rates into Several clusters,and then use the speech samples in each cluster to train a classifier based on the XGBoost algorithm.In each cluster,by introducing a multi-category training mechanism,the problem of sample imbalance can be effectively avoided,thereby improving the classification performance.We have made a series of comparisons between the proposed scheme and the detection method based on DST evidence theory in different covert communication method data sets.The experimental results show that compared with the detection method based on DST evidence theory,t he detection performance of proposed scheme in this thesis has been improved.Second,at present,most of the existing covert communication detection methods are based on the premise that the covert communication method is known,but in reality,the covert communication method is unkn own.Based on this problem,through the analysis of the data characteristics of the Vo IP streams with unknown embedding methods,this thesis proposes two detection schemes.The first is a convert communication detection scheme based on decision fusion.The scheme first trains a classifier for each convert communication method,and then merges the results given by each classifier through decision fusion.The second is a convert communication detection scheme based on self-paced ensemble.Its core idea is to train multiple classifiers based on multiple iterations.In each iteration process,by continuously searching for boundary samples,a base classifier with relatively best classification performance is provided for the ensemble classification model.The experimental results show that the two detectio n schemes proposed in this thesis can be used to detect the Vo IP streams with unknown embedding methods,and the performance of the detection scheme based on self-paced ensemble is better than that based on the d etection scheme based on decision fusion.Third,the existing covert communication detection methods are mainly aimed at a single embedded domain,but in actual scenarios,the embedded domain is usually unknown.Based on this problem,by analyzing the data characteristics of multiple embedded domains,this thesis proposes a detection scheme for covert communication methods that can be applied to multiple embedded domains.This scheme first uses embedding technology to map the codewords in each speech sequence to a continuous high-dimensional semantic space,and then uses a global pooling layer to compress the speech sequence,and then uses the splicing layer to splice multiple speech sequences.Finally,the two-layer fully connected network is used to obtain the connections between different sequences,and the final output is obtained.Experimental results show that the detection scheme proposed in this paper can be applied to the detection of covert communication methods in multiple embedded domains,and the detection performance in a single embedded domain is better than the existing covert communication detection methods.