CN109547443A - A kind of detection method of the hidden channel of network storage type - Google Patents
A kind of detection method of the hidden channel of network storage type Download PDFInfo
- Publication number
- CN109547443A CN109547443A CN201811430859.0A CN201811430859A CN109547443A CN 109547443 A CN109547443 A CN 109547443A CN 201811430859 A CN201811430859 A CN 201811430859A CN 109547443 A CN109547443 A CN 109547443A
- Authority
- CN
- China
- Prior art keywords
- cluster
- channel
- data
- point
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 13
- 238000000034 method Methods 0.000 claims abstract description 15
- 238000005259 measurement Methods 0.000 claims description 3
- 239000006185 dispersion Substances 0.000 claims 1
- 238000005516 engineering process Methods 0.000 abstract description 4
- 230000006854 communication Effects 0.000 description 7
- 230000005540 biological transmission Effects 0.000 description 6
- 238000004891 communication Methods 0.000 description 5
- 238000011161 development Methods 0.000 description 3
- 238000011160 research Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
- H04L65/60—Network streaming of media packets
- H04L65/65—Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Landscapes
- Engineering & Computer Science (AREA)
- Multimedia (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention belongs to field of information security technology, and in particular to a kind of detection method of the hidden channel of network storage type.This method includes establishing RTP Differential time stamp fitting of a polynomial model;The cluster feature of resulting model result is selected and extracted;, can be simple using clustering algorithm to determine whether there are steganography, detection that is quick and being accurately realized the hidden channel of network storage type.
Description
Technical field
The invention belongs to field of information security technology, and in particular to a kind of detection method of the hidden channel of network storage type.
Background technique
The rapid development of Internet technology and the safe transmission of widely available urgently information are as ensureing, this is also to traditional
Information transmission security scheme based on cryptographic technique proposes bigger challenge.Main cause be cryptographic technique be will be to be passed
Defeated information scramble is to achieve the purpose that secrecy, however, the messy code feature exactly shown after information encryption makes confidential information
Existence be exposed, this just excite supervisor decode information enthusiasm and desire.The ciphertext of encryption is once decrypted, just
No safety can be sayed.Secondly, the safety of cryptographic technique is built upon mathematic(al) manipulation and mathematics particular problem is difficult by principle analysis
On the basis of solving, with the arrival in quantum computer epoch, least good exhaustive computations prime factor speed is enhanced N number of
The order of magnitude can crack RSA key within the limited time.As it can be seen that the protection for private information, is paying attention to protection transmission
While the information content, it more should be noted and its existence covered up.In this scenario, the hidden channel application of network and give birth to.Network is hidden
Channel is to make illegal information flow (usually using disclosed communication data as one hidden communication channel of vector construction
Secret information) escape regular security control mechanism detection, the other side of communication is safely passed to, to push information security
The fast development and application of technology.
In the building of hidden channel, carrier is basis, and information steganography is means, good carrier and suitable steganographic algorithm
Combining could make the building of hidden channel more hidden.As it can be seen that the selection of carrier is very crucial.Due to there is a large amount of stream in network
Media data needs real-time Transmission, and RTP/RTCP agreement provides critical services thus, becomes as the master of the hidden channel build of network
Want one of object and carrier.Especially each RTP data grouping is by protocol headers (head) and valid data (payload) two
Part forms.Therefore, the hidden channel of network can be constructed using the redundant field of network protocol or valid data as load.Due to network
Hidden channel is that secret information is embedded in the redundant field of network protocol, is difficult safety equipment and detection device in network
Identification, therefore there is very strong concealment.Even if private communication channel is found, the special mechanism that building person uses makes the hidden of transmission
Secret information is unlikely to be cracked.Even if secondly, the study found that data packet carries 1bit data, then in 1 year, one
Network private communication channel can illegally steal the information of 26GB from a large-scale website, and practical value is high.As it can be seen that as main
One of streaming media transmission protocol, RTP/RTCP is widely used in the building of the hidden channel of network.How research utilizes RTP/
The redundancy of rtcp protocol carries out Information hiding and detection, is development trend and research emphasis place.
Summary of the invention
Regarding to the issue above and the deficiencies in the prior art, the present invention provides a kind of detection sides of hidden channel of network storage type
Method, method includes the following steps:
1. establishing RTP Differential time stamp fitting of a polynomial model: defining the data point of the serial number X-axis of Channel message, y-axis
Data be message time stamp difference value, it is assumed that the timestamp difference sequence of w+1 message window in communication process is calculated as
(d1, d2 ..., dW) (w >=1), it can thus be concluded that set P={ i, di to match point;) | i=1,2 ..., w;W >=1 }, P is report
The set for the time difference sequence that literary serial number and message are sent, recycles fitting of a polynomial to obtain interchannel RTP timestamp difference
Multinomial model;
2. to step 1. obtained in the cluster feature of model result selected and extracted: using formulaCalculate the absolute value area of normal c (x) He two channel matched curve of steganography h (x), and with
This is as clustering object;
3. using clustering algorithm to determine whether there are steganography:
A, it calculates separately between normal channel and w length of window timestamp difference sequence between normal channel and stego-channel
Matched curve area discrepancy degree { Sd};
B, from clustering object { SdIn repeatedly choose initial value, find most suitable k central point as initial value { C1,
C2,…Ck};
C, formula is pressedCalculate remaining each data point
With initial center point distance R (i, k), the nearest data point of distance center point is referred in cluster representated by the central point;
D, formula is usedCalculate the central point of each cluster, wherein NkIndicate cluster CkMiddle data point
Number;SdiIndicate cluster CkIn all data point;
E, step c is repeated, until error sum of squares criterion function starts convergence, i.e. the value of cluster centre no longer becomes d
Change, obtains the cluster centre point μ of each cluster of data sourcekWith the distance R of each data source to each cluster centrek;
F, according to formulaEach data source is calculated to each cluster centre μkDistance RkMean value,
In, i=1,2 ..., n, NkIndicate cluster μkThe number of central point;
G, the M for the data point that will be compared and the M of normal data points are compared, if do not changed, for normal channel, such as
It changes, is then convert channel.
Further, the step 1. in polynomial fitting method be least square method, that is, the timestamp for setting actual measurement is poor
Fraction sequence data are { dk(k=1,2,3 ..., w), w is window data points, with a polynomial functionIndicate fitting
Function, then:Wherein j=0,1,3 ..., k,It is dkEstimated value,
Observation point square is at a distance from estimation pointMake model of fit and actual observed value each point residual error (or from
Difference) EkWeighted sum of squares reach minimum, i.e.,Value reach minimum, to seek
Parameter value therein.
Further, the step 1. in fitting of a polynomial number be 3-7 times, preferably 5 times.
The beneficial effects of the present invention are:
1. simple, detection that is quick and being accurately realized the hidden channel of network storage type;
Detailed description of the invention
Fig. 1 normal channel and the difference sequence matched curve of stego-channel RTP timestamp;
Mean variation of each point that Fig. 2 window w is 50 to each cluster centre distance;
Mean variation of each point that Fig. 3 window w is 100 to each cluster centre distance;
Fig. 4 initial clustering and the comparison of secondary cluster result.
Specific embodiment
The technical scheme in the embodiments of the invention will be clearly and completely described below, it is clear that described implementation
Example is only a part of the invention, rather than the whole invented.Based on the embodiments of the present invention, ordinary skill people
Member's every other embodiment obtained without making creative work, shall fall within the protection scope of the present invention.
A kind of detection method of the hidden channel of network storage type of embodiment 1
1. establishing RTP Differential time stamp fitting of a polynomial model: defining the data point of the serial number X-axis of Channel message, y-axis
Data be message time stamp difference value, it is assumed that the timestamp difference sequence of w+1 message window in communication process is calculated as
(d1, d2 ..., dW) (w >=1), it can thus be concluded that set P={ i, di to match point;) | i=1,2 ..., w;W >=1 }, P is report
The set for the time difference sequence that literary serial number and message are sent, recycles fitting of a polynomial to obtain interchannel RTP timestamp difference
Multinomial model, polynomial fitting method is least square method, that is, sets the timestamp difference number sequence column data of actual measurement as { dk}
(k=1,2,3 ..., w), w is window data points, with a polynomial functionIndicate fitting function, then:Wherein j=0,1,3 ..., k,It is dkEstimated value, observation point with
The distance of estimation point square isMake model of fit and actual observed value in residual error (or deviation) E of each pointkPlus
Power quadratic sum reaches minimum, i.e.,Value reach minimum, fitting number is 5 times, is intended
It is as shown in Figure 1 to close result;
2. to step 1. obtained in the cluster feature of model result selected and extracted: using formulaCalculate the absolute value area of normal c (x) He two channel matched curve of steganography h (x), and with
This is as clustering object, such as Fig. 3, and the average value of normal channel data point to each cluster centre distance is constant after cluster for the first time, and
What the value of stego-channel always changed;
3. using clustering algorithm to determine whether there are steganography:
A, it calculates separately between normal channel and w length of window timestamp difference sequence between normal channel and stego-channel
Matched curve area discrepancy degree { Sd};
B, from clustering object { SdIn repeatedly choose initial value, find most suitable k central point as initial value { C1,
C2,…Ck};
C, formula is pressedCalculate remaining each data point
With initial center point distance R (i, k), the nearest data point of distance center point is referred in cluster representated by the central point;
D, formula is usedCalculate the central point of each cluster, wherein NkIndicate cluster CkMiddle data point
Number;SdiIndicate cluster CkIn all data point;
E, step c is repeated, until error sum of squares criterion function starts convergence, i.e. the value of cluster centre no longer becomes d
Change, obtains the cluster centre point μ of each cluster of data sourcekWith the distance R of each data source to each cluster centrek;
F, according to formulaEach data source is calculated to each cluster centre μkDistance RkMean value,
In, i=1,2 ..., n, NkIndicate cluster μkThe number of central point, such as Fig. 4 have obtained clustering more accurate cluster result than for the first time;
G, the M for the data point that will be compared and the M of normal data points are compared, if do not changed, for normal channel, such as
It changes, is then convert channel.
Claims (3)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201811430859.0A CN109547443B (en) | 2018-11-28 | 2018-11-28 | A Detection Method of Network Storage Type Covert Channel |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201811430859.0A CN109547443B (en) | 2018-11-28 | 2018-11-28 | A Detection Method of Network Storage Type Covert Channel |
Publications (2)
Publication Number | Publication Date |
---|---|
CN109547443A true CN109547443A (en) | 2019-03-29 |
CN109547443B CN109547443B (en) | 2023-04-25 |
Family
ID=65850637
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201811430859.0A Expired - Fee Related CN109547443B (en) | 2018-11-28 | 2018-11-28 | A Detection Method of Network Storage Type Covert Channel |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN109547443B (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110324210A (en) * | 2019-08-06 | 2019-10-11 | 杭州安恒信息技术股份有限公司 | The detection method and device of private communication channel communication are carried out based on ICMP agreement |
CN110392050A (en) * | 2019-07-18 | 2019-10-29 | 北京理工大学 | A Construction Method of Storage Covert Channel Based on Timestamp |
CN110912921A (en) * | 2019-11-29 | 2020-03-24 | 广东工业大学 | An industrial control system safety data verification system and method |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR20090129009A (en) * | 2008-06-12 | 2009-12-16 | 주식회사 케이티 | Hidden station problem detection method, adaptive RTS / CTS switching method and cancellation method |
US7920705B1 (en) * | 2006-07-26 | 2011-04-05 | Rockwell Collins, Inc. | System and method for convert channel detection |
CN102594619A (en) * | 2012-02-15 | 2012-07-18 | 南京理工大学常熟研究院有限公司 | Network covert channel detecting method |
CN104753617A (en) * | 2015-03-17 | 2015-07-01 | 中国科学技术大学苏州研究院 | Detection method of time-sequence type covert channel based on neural network |
CN105847250A (en) * | 2016-03-22 | 2016-08-10 | 甘肃农业大学 | VoIP stream media multi-dimensional information steganography real time detection method |
WO2017185433A1 (en) * | 2016-04-25 | 2017-11-02 | 深圳大学 | Steganalysis method based on hamming distance distribution |
-
2018
- 2018-11-28 CN CN201811430859.0A patent/CN109547443B/en not_active Expired - Fee Related
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7920705B1 (en) * | 2006-07-26 | 2011-04-05 | Rockwell Collins, Inc. | System and method for convert channel detection |
KR20090129009A (en) * | 2008-06-12 | 2009-12-16 | 주식회사 케이티 | Hidden station problem detection method, adaptive RTS / CTS switching method and cancellation method |
CN102594619A (en) * | 2012-02-15 | 2012-07-18 | 南京理工大学常熟研究院有限公司 | Network covert channel detecting method |
CN104753617A (en) * | 2015-03-17 | 2015-07-01 | 中国科学技术大学苏州研究院 | Detection method of time-sequence type covert channel based on neural network |
CN105847250A (en) * | 2016-03-22 | 2016-08-10 | 甘肃农业大学 | VoIP stream media multi-dimensional information steganography real time detection method |
WO2017185433A1 (en) * | 2016-04-25 | 2017-11-02 | 深圳大学 | Steganalysis method based on hamming distance distribution |
Non-Patent Citations (3)
Title |
---|
周雪;: "基于VoIP的隐蔽通信系统的研究与设计" * |
杨婉霞,等: "网络存储隐蔽信道检测的改进与优化仿真" * |
杨永周;: "隐蔽通信及安全检测防护技术探究" * |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110392050A (en) * | 2019-07-18 | 2019-10-29 | 北京理工大学 | A Construction Method of Storage Covert Channel Based on Timestamp |
CN110392050B (en) * | 2019-07-18 | 2020-11-27 | 北京理工大学 | A Construction Method of Timestamp-Based Storage Hidden Channel |
CN110324210A (en) * | 2019-08-06 | 2019-10-11 | 杭州安恒信息技术股份有限公司 | The detection method and device of private communication channel communication are carried out based on ICMP agreement |
CN110912921A (en) * | 2019-11-29 | 2020-03-24 | 广东工业大学 | An industrial control system safety data verification system and method |
CN110912921B (en) * | 2019-11-29 | 2022-02-15 | 广东工业大学 | Safety data verification system and method for industrial control system |
Also Published As
Publication number | Publication date |
---|---|
CN109547443B (en) | 2023-04-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN109327308B (en) | A quantum key distribution method and system with two-way identity authentication function | |
CN107124268B (en) | Privacy set intersection calculation method capable of resisting malicious attacks | |
KR101351012B1 (en) | Method and apparatus for authentication user in multiparty quantum communications | |
CN103581173B (en) | Safe data transmission method, system and device based on industrial Ethernet | |
JP6384314B2 (en) | Information processing method, information processing program, and information processing apparatus | |
CN103581175B (en) | A Safe Data Aggregation Method | |
CN109547443A (en) | A kind of detection method of the hidden channel of network storage type | |
JP2016131335A (en) | Information processing method, information processing program, and information processing apparatus | |
CN112185395B (en) | Federal voiceprint recognition method based on differential privacy | |
CN102012980B (en) | Security Detection Method for Text Information Hiding Based on Homomorphic Encryption System | |
WO2014029169A1 (en) | Communication method utilizing fingerprint information for authentication | |
CN116049897B (en) | Verifiable privacy protection federal learning method based on linear homomorphic hash and signcryption | |
CN107070664A (en) | A kind of quantum authorization management method based on EPR pairs and entanglement transfer | |
CN103763114A (en) | Combined quantum broadcast communication monitoring method based on partially entangled GHZ channel | |
ATE347706T1 (en) | METHOD AND DEVICE FOR IDENTIFYING AN AUTHORIZED PERSON BY MEANS OF UNPREDICTABLE, ONCE-USEABLE PASSWORDS | |
CN114866222A (en) | Ciphertext data statistical analysis system and method supporting privacy protection | |
CN103227800A (en) | Quantum secure communication wiretap detection method based on five-qubit Cluster state | |
CN105553980A (en) | Safety fingerprint identification system and method based on cloud computing | |
CN111082937B (en) | Bidirectional identity authentication method based on single photon | |
CN113141247A (en) | Homomorphic encryption method, device and system and readable storage medium | |
CN112651042A (en) | Intersection solving method based on trusted third-party private data | |
CN103051457A (en) | Method for establishing safety communication of network groups | |
CN104753935A (en) | Verification method of multiparticle quantum private comparison protocol | |
CN101888383B (en) | Method for implementing extensible trusted SSH | |
CN104821879B (en) | A kind of encryption method in electric power system data transfer |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant | ||
CF01 | Termination of patent right due to non-payment of annual fee | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20230425 |