基于生成对抗网络的网络流量特征伪装技术

doi:10.19678/j.issn.1000-3428.0053315

摘要/Abstract

摘要： 互联网服务提供商通过使用流量分析攻击技术对流量进行分类和监控，目前的防御措施多数缺乏动态性与应对网络环境变化的灵活性，而且依赖于具体的某种流量的特征，容易被探测和屏蔽。为抵御流量分析攻击，提出一种新的流量隐藏技术，代理服务器将流量动态地伪装成任意目标流量，运用生成对抗网络模型来学习目标网络流量的特征，将源流量变为与目标正常流量不可区分的流量，以保障隐私和规避互联网监控。实验结果表明，该技术在准确率等性能指标上表现良好，且拥有同类方案所不具备的动态性，明显提升了流量的匿名性。

关键词: 生成对抗网络, 网络安全, 网站指纹, 流量分析, 流量特征伪装

Abstract: Internet service providers often use traffic analysis attack technology to classify and monitor traffic.However,most of the current defense measures lack the flexibility to respond to changes in the network environment,and their dependence on specific traffic characteristics makes them easy to be detected and shielded.To defend against these attacks,we propose a new traffic hiding technology,which enables the proxy server dynamically camouflages any target traffic.We use the Generating Adversarial Network(GAN) model to learn the characteristics of the target traffic,making the source traffic indistinguishable from the target normal traffic so as to protect privacy and avoid Internet monitoring.Experimental results show that the proposed technology has better accuracy and flexibility,and the anonymity of traffic is obviously improved under the existing traffic analysis attack technology.

Key words: Generating Adversarial Network(GAN), network security, Website fingerprint, traffic analysis, traffic feature camouflage

中图分类号:

TP309

李杰, 周路, 李华欣, 闫璐, 朱浩瑾. 基于生成对抗网络的网络流量特征伪装技术[J]. 计算机工程, 2019, 45(12): 119-126.

LI Jie, ZHOU Lu, LI Huaxin, YAN Lu, ZHU Haojin. Network Traffic Feature Camouflage Technology Based on Generating Adversarial Network[J]. Computer Engineering, 2019, 45(12): 119-126.

https://www.ecice06.com/CN/Y2019/V45/I12/119

图/表 8

20191214132306

20191214132308

20191214132311

20191214132314

20191214132317

20191214132319

20191214132322

20191214132325

参考文献

[1] VICTORS J,LI M,FU X.The onion name system[J].Proceedings on Privacy Enhancing Technologies,2017(1):21-41.
[2] DYER K P,COULL S E,RISTENPART T,et al.Peek-a-boo,i still see you:why efficient traffic analysis countermeasures fail[C]//Proceedings of IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2012:332-346.
[3] LUO Xiapu,ZHOU Peng,CHAN E W W,et al.HTTPOS:sealing information leaks with browser-side obfuscation of encrypted flows[C]//Proceedings of IEEE Network and Distributed System Security Symposium.Washington D.C.,USA:IEEE Press,2011:11-23.
[4] CAI Xiang,NITHYANAND R,WANG Tao,et al.A systematic approach to developing and evaluating website fingerprinting defenses[C]//Proceedings of 2014 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2014:227-238.
[5] WRIGHT C V,COULL S E,MONROSE F.Traffic morphing:an efficient defense against statistical traffic analysis[C]//Proceedings of IEEE Network and Distributed System Security Symposium.Washington D.C.,USA:IEEE Press,2009:23-31.
[6] LIU Yunzhong,ZHANG Rui,SHI Jing,et al.Traffic inference in anonymous manets[C]//Proceedings of the 7th Annual IEEE Communications Society Conference on Sensor Mesh and Ad Hoc Communications and Networks.Washington D.C.,USA:IEEE Press,2010:1-9.
[7] LI Huaxin,XU Zheyu,ZHU Haojin,et al.Demographics inference through Wi-Fi network traffic analysis[C]//Proceedings of the 35th Annual IEEE International Conference on Computer Communications.Washington D.C.,USA:IEEE Press,2016:1-9.
[8] PANCHENKO A,LANZE F,PENNEKAMP J,et al.Website fingerprinting at internet scale[C]//Proceedings of Network and Distributed System Security Symposium.San Diego,USA:[s.n.],2016:23-32.
[9] WANG Dawei,ZHANG Luoshi,YUAN Zhenlong,et al.Characterizing application behaviors for classifying P2P traffic[C]//Proceedings of 2014 IEEE International Conference on Computing,Networking and Communications.Washington D.C.,USA:IEEE Press,2014:21-25.
[10] CHEN Yimin,JIN Xiaocong,SUN Jingchao,et al.POWERFUL:mobile App fingerprinting via power analysis[C]//Proceedings of IEEE Conference on Computer Communications.Washington D.C.,USA:IEEE Press,2017:1-9.
[11] CAI X,ZHANG X C,JOSHI B,et al.Touching from a distance:Website fingerprinting attacks and defenses[C]//Proceedings of 2012 ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2012:605-616.
[12] WANG Tao,CAI Xiang,NITHYANAND R,et al.Effective attacks and provable defenses for Website fingerprinting[C]//Proceedings of USENIX Security Symposium.Washington D.C.,USA:IEEE Press,2014:143-157.
[13] HAYES J,DANEZIS G.K-fingerprinting:a robust scalable Website fingerprinting technique[C]//Proceedings of USENIX Security Symposium.Washington D.C.,USA:IEEE Press,2016:1187-1203.
[14] CHENG Shuping,TAN Liang.Dynamic detection model in Botnet based on network traffic[J].Computer Engineering,2014,40(11):106-112.(in Chinese)成淑萍,谭良.基于网络流量的僵尸网络动态检测模型[J].计算机工程,2014,40(11):106-112.
[15] HE Gaofeng,YANG Ming,LUO Junzhou,et al.Online identification of Tor anonymous communication traffic[J].Journal of Software,2013,24(3):540-556.(in Chinese)何高峰,杨明,罗军舟,等.Tor匿名通信流量在线识别方法[J].软件学报,2013,24(3):540-556.
[16] XIE Yi,LI Man,YAN Yafang.New features of HTTP traffic in Web2.0[J].Data Communications,2015(4):33-37.(in Chinese)谢逸,李曼,颜雅芳.Web2.0下HTTP流量的新特征[J].数据通信,2015(4):33-37.
[17] JUAREZ M,IMANI M,PERRY M,et al.Toward an efficient Website fingerprinting defense[C]//Proceedings on European Symposium on Research in Computer Security.Berlin,Germany:Springer,2016:27-46.
[18] WANG Tao,GOLDBERG I.Walkie-talkie:an efficient defense against passive Website fingerprinting attacks[C]//Proceedings of the 26th IEEE USENIX Security Symposium.Washington D.C.,USA:IEEE Press,2017:1375-1390.
[19] CHERUBIN G,HAYES J,JUAREZ M.Website fingerprinting defenses at the application layer[J].Proceedings on Privacy Enhancing Technologies,2017(2):186-203.
[20] CUI Weiqi,YU Jianmin,GONG Yanmin,et al.Realistic cover traffic to mitigate Website fingerprinting attacks[C]//Proceedings of the 38th IEEE International Conference on Distributed Computing Systems.Washington D.C.,USA:IEEE Press,2018:1579-1584.
[21] MOGHADDAM H M,LI B,DERAKHSHANI M,et al.Skypemorph:protocol obfuscation for tor bridges[C]//Proceedings of 2012 ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2012:97-108.
[22] WILEY B.Dust:a blocking-resistant internet transport protocol[EB/OL].[2018-05-21].http://blanu.net/Dust.pdf.
[23] LING Zhen,LUO Junzhou,WU Kui,et al.TorWard:discovery of malicious traffic over tor[C]//Proceedings of Conference on Computer Communications.Washington D.C.,USA:IEEE Press,2014:1402-1410.
[24] BARRADAS D,SANTOS N,RODRIGUES L.Effective detection of multimedia protocol tunneling using machine learning[EB/OL].[2018-05-25].https://www.jianshu.com/p/ea289a3b73c9.
[25] LI Li,WU Zhenqiang.Research and implementation of anonymous communication scheme with multicast network coding[J].Computer Engineering,2016,42(12):97-101.(in Chinese)李立,吴振强.多播网络编码匿名通信方案研究与实现[J].计算机工程,2016,42(12):97-101.
[26] GOODFEOOW I,POUGET-ABADIE J,MIRZA M,et al.Generative adversarial nets[C]//Proceedings of Conference on Neural Information Processing Systems.Washington D.C.,USA:IEEE Press,2014:2672-2680.
[27] ARJOVSKI M,CHINTALA S,BOTTOU L.Wasserstein generative adversarial networks[C]//Proceedings of International Conference on Machine Learning.Washington D.C.,USA:IEEE Press,2017:214-223.
[28] GULRAJANI I,AHMED F,ARJOVSKY M,et al.Improved training of wasserstein gans[C]//Proceedings of International Conference on Neural Information Processing Systems.Washington D.C.,USA:IEEE Press,2017:5767-5777.
[29] TIELEMAN T,HINTON G.Lecture 6.5-rmsprop:divide the gradient by a running average of its recent magnitude[J].Neural Networks,2012,4(2):26-31.
[30] KINGMA D P,BA J.Adam:a method for stochastic optimization[J].Computer Science,2014(115):1125-1137.
[31] HERRMANN D,WENDOLSKY R,FEDERRATH H.Website fingerprinting:attacking popular privacy enhancing technologies with the multinomial Naïve-Bayes classifier[C]//Proceedings of 2009 ACM Workshop on Cloud Computing Security.New York,USA:ACM Press,2009:31-42.
[32] LIBERATORE M,LEVINE B N.Inferring the source of encrypted HTTP connections[C]//Proceedings of the 13th ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2006:255-263.
[33] SUN Qixiang,SIMON D R,WANG Y M,et al.Statistical identification of encrypted Web browsing traffic[C]//Proceedings of IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2002:124-136.

选择文件类型/文献管理软件名称

选择包含的内容