欢迎您！东篱公司
退出
-
申报数据库
-
立项数据库
-
成果数据库
-
项目获奖数据库
中文摘要：
目前在Internet上广泛部署的SSH单代理匿名通信系统利用其动态端口转发功能,在用户和代理之间构建加密隧道,通过对数据进行加密封装和转发,隐藏用户所访问站点的真实地址.为了实现对匿名Web访问的监管,现有工作基于流量分析技术提出了多种针对网站主页的指纹攻击方法,但在如何对目标网站建模、如何选择区分度高的流量特征以提高攻击准确率等问题上仍需进一步的研究.针对这些问题,深入分析SSH匿名流量的特征,提出一种新型的网站指纹攻击方法.该方法基于上下行流量的不同特性,分别抽取不同的区分度高的特征形成上下行指纹,并采取相应的匹配算法进行指纹比对.在此基础上,根据用户访问关联Web页面的行为模式,对所监管的目标网站建立隐马尔科夫模型,将目前只针对网站主页的识别扩展到了多级页面.通过使用公开数据集和在Internet环境中部署实验进行验证,该攻击方法获得了96.8%的准确率,可以有效地识别被监管者所访问的网站.
英文摘要：
As a single-hop anonymous system, SSH proxy is currently widely deployed in the Internet. By establishing an encrypted tunnel between the proxy and its client with dynamic port forwarding, SSH encapsulates all traffic through the tunnel. Hence, the identities of users＇ destination wehsites can be hidden. To prevent the anonymity abuse caused by the SSH proxy, the existing work utilized traffic analysis techniques and proposed some website fingerprinting attacks on the target of the homepage. However, several issues should be further well addressed, mainly including how to model the interesting websites and select traffic features with high distinguishability to achieve better accuracy. In this paper, we extract different features of incoming and outgoing flows and present a novel website fingerprinting attack based on hyperlink relations. The main idea is extending the current homepage targeted website fingerprinting attack to subpages. In order to realize the attack, we construct a Hidden Markov Model for the interesting website by simulating users＇ navigation behaviors. We then evaluate the attack by public dataset and real-world deployment. Our experiments confirm that the website fingerprinting attack based on link relations is able to classify anonymous traces with nearly 96.8% accuracy, which can be used to uncover the real identities of the websites requested by users efficiently.
同期刊论文项目
同项目期刊论文
期刊信息
位置：