CN105404797B - A kind of Active Networks streaming digital water mark method based on dual redundant - Google Patents

Abstract

The idea of double redundancy in an active network stream digital watermarking method based on double redundancy in the present invention means that each watermark W _i corresponds to a large time interval R _i , and each large time interval discrete Contains r small time intervals g, the watermark W _i will be repeatedly embedded in r different small intervals g; at the same time, each g interval contains multiple data packet sequences, and finally achieves The purpose of embedding the watermark; by adopting the double redundancy method, the stability of the embedded watermark in the network propagation process can be effectively improved, the effective detection rate of the watermark at the receiving end can be improved, and the false detection rate can be reduced. Adopting the dual redundancy-based active network flow digital watermark embedding method of the present invention can effectively ensure that the watermark embedded at the sending end can reach the receiving end more safely, improve the detection efficiency of the watermark at the receiving end, and effectively judge the communication relationship between the sending end and the receiving end Provide evidence.

Description

An Active Network Stream Digital Watermarking Method Based on Double Redundancy

technical field

The invention relates to the field of active network flow watermark in digital watermark, in particular to a method for realizing watermark embedding by operating time series by utilizing double redundancy, and an active network flow watermark embedding and extracting system.

Background technique

In recent years, with the explosive development of the Internet, network security issues have become increasingly serious, especially driven by economic interests, various network attacks have emerged one after another, causing huge losses to users. On the one hand, in order to evade detection and tracking, attackers often do not directly attack the target host, but log in to the springboard node host and use anonymous communication systems, botnets and other means to hide their real identities. On the other hand, because some criminals use anonymous communication systems to spread pornography, violence and other bad information, which seriously pollutes the network environment, but the criminal evidence collection of these acts is facing severe challenges.

Faced with the above problems, traditional intrusion detection systems mainly use passive network traffic analysis methods. This type of method mainly collects network traffic through nodes arranged at key positions in the network, and confirms the matching relationship between network streams by analyzing and comparing the number, size, timing and other characteristics of data packets in each network traffic. However, this method needs to capture and inspect all network traffic, which will significantly increase the time and space overhead of network equipment. Its offline analysis mode also leads to recognition lag, poor real-time performance, and poor scalability. It is difficult to cope with large-scale and high-bandwidth networks. environment, it is even more powerless in an encrypted anonymous communication system.

Aiming at the deficiencies of traditional passive detection systems and the difficulty of tracking and locating in encrypted traffic and anonymous communication systems, many scholars have added digital watermarks to network traffic and proposed Active Network Watermarking (ANFW) technology.

The active network watermarking technology mainly draws on the idea of digital watermarking, by actively changing some characteristics of the traffic generated by the sending end, so that it can covertly carry some special marking information, that is, watermark (watermark), after network transmission , and the corresponding watermark is detected from the network traffic received by the receiving end, it is considered that there is a network traffic correlation between the sending end and the receiving end, so that it can be determined that there is a clear network communication between them.

Active network flow watermark (ANFW) can be described as a six-tuple <OF, W, AP, EM, DE, CM>, where OF (original flows) is the original network flow set; W is the embedded watermark information, W = {w ₁ ,w ₂ ,...,w _l },|W|=l(l>0), w _i is the watermark information, the value is 0 or 1, l is the watermark capacity; AP(assist parameters) It is the auxiliary parameter set needed when embedding watermark in the stream, and different network stream watermarks have different parameters; EM is the modulation or embedding watermark function; DE is the demodulation or extraction watermark function; CM is the comparison function.

Contents of the invention

The purpose of the invention is to overcome the deficiencies of the prior art and provide an active network flow digital watermarking method based on double redundancy.

The technical solution adopted by the present invention to solve the technical problem is to provide a dual redundancy-based active network stream digital watermarking method, including: a dual redundancy-based active network stream digital watermarking method, characterized in that it includes the following step:

A1. Capture the data flow T _f sent by the sender on the border route, and determine the parameter offset o required for watermark embedding, and the data flow segment T _d that needs to embed the watermark;

A2. Divide the T _d segment into 2n equal parts of equal size, each of which includes k data packets, where n=l*r, l is the number of watermarks that need to be embedded, k is the first redundancy, and r is the first double redundancy;

A3. Divide every two adjacent intervals into a group, a total of n groups, namely g ₀ , g ₁ , g ₂ ,...,g _j ,...,g _n-1 , and then divide the n Each g group is randomly divided into l large groups, namely R ₀ , R ₁ ,...,R _i ,...,R _l-1 , and each large group contains r g groups;

A4. Each watermark W _i corresponds to one R _i group. In the R _i group, the watermark will be embedded in r g groups respectively by using the data packet interval;

A5, cycle step 4 for l times, and finally embed all watermarks;

A6. Put the watermark-embedded data stream back into the network, and at the same time upload various parameters required for embedding the watermark and the original watermark W to the third-party agent.

Preferably, the data flow sent to the receiving end is captured on the border route of the receiving end, and various parameters required for watermark detection and the original watermark W are obtained from a third-party agent.

Preferably, the parameters are used to divide the captured data stream into the same interval, and within the divided interval, the watermark detection function is used to obtain the watermark information carried by each group g.

Preferably, the watermark with the most occurrences in the R _i group is counted, and the watermark value is the final watermark finally carried by the R _i group.

Preferably, the watermark W' extracted by the receiving end is compared with the original watermark W, if they are the same, there is a clear communication relationship between the sending end and the receiving end, otherwise, the communication relationship cannot be determined.

Preferably, the specific steps of the method for detecting double redundant embedded watermarks are:

B1. Extract the received data flow T _f ' at the entrance of the network flow at the receiving end;

B2. Obtain various parameters required for watermark extraction from a third-party agent, such as offset o, redundancy k, r, original watermark W, and total number of watermarks l, etc.;

B3. Using the obtained watermark embedding parameters, re-divide the data stream T _f ' at the receiving end into l R groups, namely R ₀ ', R ₁ ', R ₂ ',...,R _i ',..., R _l-1 ', and each R' group contains r g'groups;

B4. Calculate the i-th watermark w _i ', that is, use the idea of data packet interval to calculate the watermark values carried in r g' groups in R _i ' respectively, and r watermarks w _ij '(j=0,1, ...r-1);

B5. Among the r watermarks w _ij ', the watermark value with the most occurrence times is counted, and this value is the final value of the watermark carried by the R _i ' group.

B6, loop step 4 and step 51 times, obtain the watermark sequence W ' of receiving end;

B7. Compare the watermark sequence W of the sending end with the watermark sequence W' detected by the receiving end using the CM comparison function. If they are the same, there is a definite communication relationship between the sending end and the receiving end. Otherwise, the communication relationship cannot be determined.

The beneficial effects of the present invention are: according to the system and method of the present invention, the idea of double redundancy means that each watermark W _i corresponds to a large time interval R _i , and each large time interval contains r For a small time interval g, the watermark W _i will be repeatedly embedded in r different small intervals g; at the same time, each g interval contains multiple data packet sequences, and finally the embedding watermark is achieved by manipulating the data packet time sequence The purpose; by adopting the double redundancy method, the stability of the embedded watermark in the network propagation process can be effectively improved, the effective detection rate of the watermark at the receiving end can be improved, and the false detection rate can be reduced. Adopting the dual redundancy-based active network flow digital watermark embedding method of the present invention can effectively ensure that the watermark embedded at the sending end can reach the receiving end more safely, improve the detection efficiency of the watermark at the receiving end, and effectively judge the communication relationship between the sending end and the receiving end Provide evidence.

Description of drawings

Figure 1 is a schematic diagram of a dual redundant watermark embedding model;

Figure 2 is a schematic diagram of a dual redundant watermark embedding process;

Fig. 3 is a schematic diagram of a double redundant watermark detection process;

Figure 4 is a schematic diagram of an active network flow watermark embedding and detection model.

Detailed ways

Example 1

Referring to Fig. 1 and shown in Fig. 2, a kind of active network flow digital watermarking method based on double redundancy of the present invention, comprises: A kind of active network flow digital watermarking method based on double redundancy, it is characterized in that, comprises the following steps:

A1. Capture the data flow T _f sent by the sender on the border route, and determine the parameter offset o required for watermark embedding, and the data flow segment T _d that needs to embed the watermark;

A2. Divide the T _d segment into 2n equal parts of equal size, each of which includes k data packets, where n=l*r, l is the number of watermarks that need to be embedded, k is the first redundancy, and r is the first double redundancy;

A3. Divide every two adjacent intervals into a group, a total of n groups, namely g ₀ , g ₁ , g ₂ ,...,g _j ,...,g _n-1 , and then divide the n Each g group is randomly divided into l large groups, namely R ₀ , R ₁ ,...,R _i ,...,R _l-1 , and each large group contains r g groups;

A4. Each watermark W _i corresponds to one R _i group. In the R _i group, the watermark will be embedded in r g groups respectively by using the data packet interval;

A5, cycle step 4 for l times, and finally embed all watermarks;

A6. Put the watermark-embedded data stream back into the network, and at the same time upload various parameters required for embedding the watermark and the original watermark W to the third-party agent.

Furthermore, the data flow sent to the receiving end is captured on the border route of the receiving end, and various parameters required for watermark detection and the original watermark W are obtained from a third-party agent.

Furthermore, the captured data stream is divided into the same interval by using the parameters, and the watermark information carried by each group g is obtained by using the watermark detection function within the divided interval.

Furthermore, the watermark with the most occurrences in the R _i group is counted, and the watermark value is the final watermark carried by the R _i group.

Furthermore, compare the watermark W' extracted by the receiving end with the original watermark W, if they are the same, there is a clear communication relationship between the sending end and the receiving end, otherwise, the communication relationship cannot be determined.

Furthermore, the specific steps of the detection method after embedding the watermark to the double redundancy are as follows:

B1. Extract the received data flow T _f ' at the entrance of the network flow at the receiving end;

B2. Obtain various parameters required for watermark extraction from a third-party agent, such as offset o, redundancy k, r, original watermark W, and total number of watermarks l, etc.;

B3. Using the obtained watermark embedding parameters, re-divide the data stream T _f ' at the receiving end into l R groups, namely R ₀ ', R ₁ ', R ₂ ',...,R _i ',..., R _l-1 ', and each R' group contains r g'groups;

B4. Calculate the i-th watermark w _i ', that is, use the idea of data packet interval to calculate the watermark values carried in r g' groups in R _i ' respectively, and r watermarks w _ij '(j=0,1, ...r-1);

B5. Among the r watermarks w _ij ', the watermark value with the most occurrence times is counted, and this value is the final value of the watermark carried by the R _i ' group.

B6, loop step 4 and step 51 times, obtain the watermark sequence W ' of receiving end;

B7. Compare the watermark sequence W of the sending end with the watermark sequence W' detected by the receiving end using the CM comparison function. If they are the same, there is a definite communication relationship between the sending end and the receiving end. Otherwise, the communication relationship cannot be determined.

Figure 1 shows the specific operation of watermark embedding on the data stream using double redundancy, and Figure 2 shows the specific flow chart of this operation. Below in conjunction with Fig. 1 and Fig. 2, the specific implementation manner of utilizing double redundancy to carry out watermark embedding is further described, mainly including the following steps:

Step 1. The proxy running on the border router receives the data flow sent by the sender.

Step 2, select the appropriate offset o and the data segment T _d to embed the watermark.

Step 3: In the T _d section, use the first redundancy, the second redundancy and other required parameters to divide and group the data stream at intervals to obtain l R groups.

Step 4, embed the watermark w _i into its corresponding R _i group through the watermark embedding function.

Step 5, repeat step 4 for l times until all watermarks are embedded.

Step 6, forwarding the watermark-embedded data flow to the network through the border route. And dump the original watermark W and various parameters required for embedding the watermark to a third-party agent.

At this point, the data stream at the sending end carrying the watermark has flowed to the network. In order to verify the communication relationship between the sending end and the receiving end, it should also be detected at the receiving end whether the watermark carried by the data stream is the same as the watermark embedded at the sending end.

Figure 3 shows a detailed flow chart of extracting the watermark from the received data stream at the receiving end. The main steps are as follows:

Step 1, the proxy running on the border router captures the data flow T _f ' sent to the receiving end.

Step 2. Obtain various parameters of the watermark embedding and the original watermark W from the third-party agent.

Step 3: Divide the received data stream into intervals according to the parameter values, and use the watermark detection function to obtain the watermark carried by each group g'.

Step 4, each R _i ' group contains r g' groups, count the watermark with the most occurrences in the R _i ' group, and the watermark value is the final watermark value of w _i '. This step is repeated 1 times to obtain the final watermark W'.

Step 5. Compare the detected watermark W' with the original watermark W of the embedding end. If they are the same, there is an obvious communication relationship between the sending end and the receiving end. Otherwise, it cannot be proved.

Figure 4 shows a schematic diagram of the overall process framework of active network stream watermarking. It can be seen from the figure that the data stream at the sending end first passes through the watermark embedding device, and the watermark embedding parameters are determined according to the actual data, and then the data stream is realized through the watermark embedding function. Embed the watermark of the system, and upload various parameters required for watermark embedding to the third-party agent; the data stream is sent to the actual network after passing through the watermark embedding device. At the receiving end, the watermark detection device first obtains the parameters required for detection from the third-party agent, and captures the data stream sent to the receiving end, and obtains the watermark carried by the data stream through a series of watermark extractions. The original watermark at the receiving end is compared with the watermark extracted at the receiving end, and the communication relationship between the sending end and the receiving end is judged according to whether the watermarks at both ends are the same.

The above-mentioned embodiments are only used to further illustrate a dual redundancy-based active network stream digital watermarking method of the present invention, but the present invention is not limited to the embodiments, and any simple modification made to the above embodiments based on the technical essence of the present invention Modifications, equivalent changes and modifications all fall within the protection scope of the technical solution of the present invention.

Claims (6)

1. a kind of active network flow digital watermarking method based on double redundancy, is characterized in that, comprises the steps: A1. Capture the data flow T _f sent by the sender on the border route, and determine the parameter offset o required for watermark embedding, and the data flow segment T _d that needs to embed the watermark; A2. Divide the T _d segment into 2n equal parts of equal size, each of which includes k data packets, where n=l*r, l is the number of watermarks that need to be embedded, k is the first redundancy, and r is the first double redundancy; A3. Divide every two adjacent intervals into a group, a total of n groups, namely g ₀ , g ₁ , g ₂ ,...,g _j ,...,g _n-1 , and then divide the n Each g group is randomly divided into l large groups, namely R ₀ , R ₁ ,...,R _i ,...,R _l-1 , and each large group contains r g groups; A4. Each watermark W _i corresponds to one R _i group. In the R _i group, the watermark will be embedded in r g groups respectively by using the data packet interval; A5, cycle step 4 for l times, and finally embed all watermarks; A6. Put the watermark-embedded data stream back into the network, and at the same time upload various parameters required for embedding the watermark and the original watermark W to the third-party agent. 2. A kind of active network stream digital watermarking method based on double redundancy according to claim 1, is characterized in that: capture the data stream sent to the receiving end on the border route of the receiving end, and obtain the watermark detection result from a third-party agent Various parameters required and the original watermark W. 3. A kind of active network flow digital watermark method based on double redundancy according to claim 1, it is characterized in that: utilize parameter to carry out the same interval division to the captured data flow, in the divided interval, utilize watermark to detect function to obtain the watermark information carried by each group g. 4. A kind of active network flow digital watermarking method based on double redundancy according to claim 1, is characterized in that: count the watermark with the largest number of occurrences in the R _i group, and this watermark is the final final carried by the R _i group watermark. 5. A kind of active network flow digital watermarking method based on double redundancy according to claim 1, characterized in that: the watermark W' extracted by the receiving end is compared with the original watermark W, if they are the same, the sending end and the receiving end There is a clear communication relationship between the terminals, otherwise, the communication relationship cannot be determined. 6. A kind of active network stream digital watermarking method based on double redundancy according to claim 5, is characterized in that: also comprise the detection method after double redundancy is embedded watermark, concrete steps are: B1. Extract the received data flow T _f ' at the entrance of the network flow at the receiving end; B2. Obtain various parameters required for watermark extraction from a third-party agent, including offset o, redundancy k, r, The original watermark W, and the total number of watermarks l; B3. Using the obtained watermark embedding parameters, re-divide the data stream T _f ' at the receiving end into l R groups, namely R ₀ ', R ₁ ', R ₂ ',...,R _i ',..., R _l-1 ', and each R' group contains r g'groups; B4. Calculate the i-th watermark w _i ', that is, use the idea of data packet interval to calculate the watermark values carried in r g' groups in R _i ' respectively, and r watermarks w _ij '(j=0,1, ...r-1); B5. Among the r watermarks w _ij ', count the watermark value with the most occurrences, then the watermark value is the final value of the watermark carried by the R _i 'group; B6, loop step 4 and step 51 times, obtain the watermark sequence W ' of receiving end; B7. Compare the watermark sequence W of the sending end with the watermark sequence W' detected by the receiving end using the CM comparison function. If they are the same, there is a definite communication relationship between the sending end and the receiving end. Otherwise, the communication relationship cannot be determined.