基于侧信道攻击的匿名通信流量识别、分析和追踪技术研究

Since anonymous abuses render a great challenge for network security, our NSFC project in progress focuses on the traceback of anonymous communications by exploiting active traffic analysis techniques. On the network traffic layer, the target sites can be effectively identified by measuring sample mean and sample variance of the round-trip time (RTT) between a suspected user and websites over single SSH proxy. The novel watermarking mechanism was further proposed for tracing anonymous traffic over multi-agent anonymous system, which exploits both direct sequence spread spectrum coding and the interval centroid-based watermarking method. To achieve efficient traceback on the anonymous protocol layer, some hidden signals are embedded into the packet flow by modulating the delay of cells in Tor anonymous network. On the communication content layer, the tracking method for confirming communication relationships over the Anonymizer network was proposed by utilizing the Least Significant Packet (LSP) concept. Furthermore, a novel anonymous web traffic tracking method was designed by using the Secret Traffic Generator. These results have been accepted or published by the international journals of TON, FGCS, JNCA, and other conferences such as INFOCOM, respectively..The follow-up work aims to further deepen and expand the study of existing work, which will focus on the effective supervision of anonymous communication. First, we plan to design a fast and efficient method for identifying anonymous traffic. Based on the anonymous protocol identified, appropriate network flow characteristics will then be chosen to classify the applications over the anonymous traffic. Finally, considering typical anonymous communication applications such as HTTP, the content analysis method based on the flow fingerprint will be designed to speculate the potential communication targets, followed with an adaptive watermarking mechanism for confirming the communication relationships over the anonymous network. The research results will serve as necessary means for monitoring users’ anonymous communication behaviors.

针对匿名滥用问题，青年基金项目采用主动流量分析技术进行了匿名通信追踪技术的研究。在通信流层，针对SSH单代理匿名通信系统提出了基于RTT统计特性的目标站点分析方法，针对多代理匿名系统设计了基于直序扩频编码、时隙质心载体的流水印追踪方案。通过调制Tor信元间隔，实现了在匿名协议层嵌入隐蔽信号的高效追踪机制。在内容层，提出了基于LSP报文的Anonymizer通信关系确认方案和基于隐秘流量生成器的匿名Web流量追踪方法。这些工作已被TON、INFOCOM、FGCS、JNCA等国际期刊和会议录用或发表。.拟开展的后续工作是目前研究的进一步深入和扩展，将首先提出快速、高效的匿名通信流量识别方法，在此基础上选择合适的网络流特征对匿名通信流量进行上层应用分类，重点针对HTTP等典型匿名通信流量，进一步设计基于流量指纹的内容分析方法以推测潜在的通信目标，并制定自适应的流水印追踪方案对通信关系进行确认。

针对匿名通信滥用问题，本项目采用侧信道攻击的基本思路，研究匿名通信流量识别、应用分类、内容分析和水印追踪等技术。针对Tor匿名通信系统，提出了基于TLS指纹和报文长度分布特征两种匿名通信流量识别方法，分别具有较好的识别率和通用性。由于通信目的节点为匿名节点即可判断为匿名通信流量，进一步设计了基于Email、Tor HTTPS服务器和Tor中间节点的隐藏Bridge节点大规模发现方法。基于Tor客户端发起和Bridge节点的连接时采用非阻塞方式，即在极短时间内会向用户提供的所有Bridge节点批量发送SYN报文的特点，设计了基于端口连续性和时间相关性的从已知Bridge节点扩展获得未知Bridge节点的方法。在识别匿名通信流量的基础上，提出了一种基于Profile隐马尔科夫模型的匿名流量应用分类方法，可用于推测目标用户正在进行何种匿名网络活动，包括匿名Web浏览、匿名P2P下载等。针对其中的匿名HTTP流量，重点进行了Web站点指纹攻击技术的研究，实现对用户匿名访问的Web站点的识别。针对被动流量分析识别效果易受干扰的问题，首次提出了主动Web站点指纹攻击的概念和方法，即通过主动延迟用户发出的请求报文来获得较为完整的Web对象大小，从而生成更为清晰的Web站点指纹。针对现有工作威胁模型缺乏实用性的问题，以存在背景流量为切入点提出一种更为实用的新型Web站点指纹攻击方法。匿名通信流量追踪本质上是对匿名通信关系的确认。针对Anonymizer系统提出了LSP报文的概念，通过调制其Web流量的报文大小嵌入隐蔽信息，从而确定Anonymizer通信双方的通信关系。此外，基于匿名协议设计了两阶段的Tor隐藏服务定位方法，为了提高流量追踪技术的性能设计了一种新型的SWDM序贯水印检测模型。围绕上述工作，项目组在包括IEEE ComMag、TPDS、TIFS、TC、CCS、INFOCOM、《中国科学》在内的期刊和会议上发表论文31篇，获得国家发明专利授权5项，获得2016年度江苏省科学技术二等奖1项。培养博硕士研究生11人，其中1人获得2014 ACM中国优秀博士论文奖和2015 CCF优秀博士学位论文奖。