CN109547443B - A Detection Method of Network Storage Type Covert Channel - Google Patents

Abstract

The invention belongs to the technical field of information security, and particularly relates to a detection method of a network storage type hidden channel. Establishing an RTP differential time stamp polynomial fitting model; selecting and extracting the clustering features of the obtained model result; whether steganography exists or not is judged by using a clustering algorithm, and detection of network storage type hidden channels can be simply, rapidly and accurately achieved.

Description

A Detection Method of Network Storage Type Covert Channel

technical field

The invention belongs to the technical field of information security, and in particular relates to a detection method of a network storage type covert channel.

Background technique

The rapid development and widespread popularization of Internet technology urgently require the secure transmission of information as a guarantee, which also poses a greater challenge to the traditional information transmission security scheme based on cryptography. The main reason is that cryptographic technology scrambles the information to be transmitted to achieve the purpose of confidentiality. However, it is the garbled character of encrypted information that exposes the existence of confidential information, which stimulates the desire of monitors to decipher information. Passion and desire. Once the encrypted ciphertext is deciphered, there is no security at all. Secondly, from the principle analysis, the security of cryptography is based on the mathematical transformation and the difficulty of solving specific mathematical problems. With the advent of the quantum computer era, the speed of the most unfavorable exhaustive calculation of prime factors will be increased by N orders of magnitude. Ability to crack RSA keys in a limited amount of time. It can be seen that for the protection of private information, while focusing on protecting the content of the transmitted information, more attention should be paid to concealing its existence. In this scenario, network covert channel applications emerge. The network covert channel constructs a covert communication channel based on public communication data, so that illegal information flow (usually secret information) can escape the detection of conventional security control agencies and be safely transmitted to the communication counterparty, thereby promoting The rapid development and application of information security technology.

In the construction of covert channels, the carrier is the foundation, and information steganography is the means. The combination of a good carrier and a suitable steganographic algorithm can make the construction of the covert channel more concealed. It can be seen that the choice of carrier is critical. Since a large amount of streaming media data needs to be transmitted in real time in the network, the RTP/RTCP protocol provides important services for this, and has become one of the main objects and carriers for network hidden channel construction. In particular, each RTP data packet is composed of two parts: a protocol header (head) and a valid data (payload). Therefore, network hidden channels can be constructed with redundant fields or valid data of network protocols as payloads. Since network covert channels embed secret information in redundant fields of network protocols, it is difficult for security devices and detection devices in the network to identify them, so they have strong concealment. Even if the covert channel is discovered, the special mechanism adopted by its builder prevents the secret information transmitted from being cracked. Secondly, the study found that even if a data packet carries 1 bit of data, a network covert channel can illegally steal 26GB of information from a large website within a year, which is of extremely high practical value. It can be seen that, as one of the main streaming media transmission protocols, RTP/RTCP is widely used in the construction of network hidden channels. Research on how to use the redundancy of the RTP/RTCP protocol for information hiding and detection is the development trend and the focus of research.

Contents of the invention

In view of the above problems and the deficiencies of the prior art, the present invention provides a method for detecting a network storage type covert channel, the method comprising the following steps:

①Establish the RTP differential timestamp polynomial fitting model: define the serial number of the channel message as the data point on the x-axis, and the data on the y-axis as the differential value of the message timestamp, assuming that w+1 message windows in the communication process The time stamp difference sequence is counted as (d1, d2, ..., dW) (w≥1), thus the set of points to be fitted is P={i, di;)|i=1, 2, ..., w; w≥1}, P is the set of the sequence number of the message and the time difference sequence sent by the message, and then use the polynomial fitting to obtain the polynomial model of the RTP time stamp difference between the channels;

计算正常c(x)和隐写h(x)两信道拟合曲线的绝对值面积，并以此作为聚类对象；② Select and extract the clustering features of the model results obtained in step ①: use the formula

Calculate the absolute value area of the two channel fitting curves of normal c(x) and steganographic h(x), and use this as the clustering object;

③ Use clustering algorithm to judge whether there is steganography:

a. Calculate the area difference {S _d } of the fitting curve of the time stamp difference sequence of w window length between the normal channels and between the normal channel and the steganographic channel respectively;

b. Select the initial value multiple times from the clustering object {S _d }, and find the most suitable k center points as the initial value {C ₁ , C ₂ ,...C _k };

计算剩余每个数据点与初始中心点的距离R(i,k)，将距离中心点最近的数据点归类到该中心点所代表的簇中；c. According to the formula

Calculate the distance R(i,k) between each remaining data point and the initial center point, and classify the data points closest to the center point into the cluster represented by the center point;

计算出每个簇的中心点，其中，N_k表示簇C_k中数据点的个数；S_di表示簇C_k中所有的数据点；d. Use the formula

Calculate the central point of each cluster, where N _k represents the number of data points in the cluster C _k ; S _di represents all the data points in the cluster C _k ;

e. Repeat steps c and d until the error square sum criterion function starts to converge, that is, the value of the cluster center does not change anymore, and the cluster center point μ _k of each cluster of the data source and each data source to each cluster center are obtained The distance R _k ;

计算每个数据源到各聚类中心μ_k的距离R_k的均值，其中，i＝1,2,…,n，N_k表示簇μ_k中心点的个数；f. According to the formula

Calculate the mean value of the distance R _k from each data source to each cluster center μ _k , wherein, i=1, 2,..., n, N _k represents the number of cluster μ _k central points;

g. Compare the M of the data point to be compared with the M of the normal data point. If there is no change, it is a normal channel, and if there is a change, it is a covert channel.

表示拟合函数，则：

其中j＝0,1,3,...,k，

是d_k的估计值，观测点与估计点的距离的平方为

使拟合模型与实际观测值在各点的残差(或离差)E_k的加权平方和达到最小，即

的值达到最小，以求取其中的参数值。Further, the polynomial fitting method in step ① is the least squares method, that is, the measured sequence data of time stamp difference is set as {d _k }(k=1,2,3,...,w), w For the number of data points in the window, use a polynomial function

Represents the fitting function, then:

where j=0,1,3,...,k,

is the estimated value of d _k , the square of the distance between the observation point and the estimated point is

To minimize the weighted sum of squares of the residual (or dispersion) _Ek between the fitted model and the actual observation at each point, that is

The value reaches the minimum, in order to obtain the parameter value.

Further, the number of polynomial fittings in step ① is 3-7 times, preferably 5 times.

The beneficial effects of the present invention are:

①Simple, fast and accurate detection of network storage hidden channels;

Description of drawings

Fig. 1 Fitting curve of normal channel and steganographic channel RTP timestamp difference sequence;

Figure 2 The average change of the distance from each point where the window w is 50 to each cluster center;

Figure 3 The average change of the distance from each point where the window w is 100 to each cluster center;

Figure 4 Comparison of initial clustering and secondary clustering results.

specific embodiment

The following will clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only a part of the present invention, rather than the whole of the invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Embodiment 1 A detection method of a network storage type covert channel

表示拟合函数，则：

其中j＝0,1,3,...,k，

是d_k的估计值，观测点与估计点的距离的平方为

使拟合模型与实际观测值在各点的残差(或离差)E_k的加权平方和达到最小，即

的值达到最小，拟合次数为5次，拟合结果如图1所示；①Establish the RTP differential timestamp polynomial fitting model: define the serial number of the channel message as the data point on the x-axis, and the data on the y-axis as the differential value of the message timestamp, assuming that w+1 message windows in the communication process The time stamp difference sequence is counted as (d1, d2, ..., dW) (w≥1), thus the set of points to be fitted is P={i, di;)|i=1, 2, ..., w; w≥1}, P is the set of the sequence number of the message and the time difference sequence sent by the message, and then use the polynomial fitting to obtain the polynomial model of the RTP timestamp difference between the channels. The polynomial fitting method is the least square method, that is, set The measured timestamp difference sequence data is {d _k }(k=1,2,3,...,w), w is the number of window data points, and a polynomial function is used

Represents the fitting function, then:

where j=0,1,3,...,k,

is the estimated value of d _k , the square of the distance between the observation point and the estimated point is

To minimize the weighted sum of squares of the residual (or dispersion) _Ek between the fitted model and the actual observation at each point, that is

The value of is the minimum, the number of fittings is 5 times, and the fitting results are shown in Figure 1;

计算正常c(x)和隐写h(x)两信道拟合曲线的绝对值面积，并以此作为聚类对象，如图3，初次聚类后正常信道数据点到各聚类中心距离的平均值不变，而隐写信道的该值总是变化的；② Select and extract the clustering features of the model results obtained in step ①: use the formula

Calculate the absolute value area of the two channel fitting curves of normal c(x) and steganographic h(x), and use this as the clustering object, as shown in Figure 3, after the initial clustering, the distance between the normal channel data point and each cluster center The average value does not change, while the value of the steganographic channel always changes;

③ Use clustering algorithm to judge whether there is steganography:

a. Calculate the area difference {S _d } of the fitting curve of the time stamp difference sequence of w window length between the normal channels and between the normal channel and the steganographic channel respectively;

b. Select the initial value multiple times from the clustering object {S _d }, and find the most suitable k center points as the initial value {C ₁ , C ₂ ,...C _k };

计算剩余每个数据点与初始中心点的距离R(i,k)，将距离中心点最近的数据点归类到该中心点所代表的簇中；c. According to the formula

Calculate the distance R(i,k) between each remaining data point and the initial center point, and classify the data points closest to the center point into the cluster represented by the center point;

计算出每个簇的中心点，其中，N_k表示簇C_k中数据点的个数；S_di表示簇C_k中所有的数据点；d. Use the formula

Calculate the central point of each cluster, where N _k represents the number of data points in the cluster C _k ; S _di represents all the data points in the cluster C _k ;

e. Repeat steps c and d until the error square sum criterion function starts to converge, that is, the value of the cluster center does not change anymore, and the cluster center point μ _k of each cluster of the data source and each data source to each cluster center are obtained The distance R _k ;

计算每个数据源到各聚类中心μ_k的距离R_k的均值，其中，i＝1,2,…,n，N_k表示簇μ_k中心点的个数，如图4，得到了比初次聚类更准确的聚类结果；f. According to the formula

Calculate the average value of the distance R _k from each data source to each cluster center μ _k , where i=1, 2,..., n, N _k represents the number of center points of the cluster μ _k , as shown in Figure 4, the ratio More accurate clustering results for initial clustering;

g. Compare the M of the data point to be compared with the M of the normal data point. If there is no change, it is a normal channel, and if there is a change, it is a covert channel.

Claims (3)

1. A detection method of a network storage type covert channel, characterized in that the method comprises the following steps: ①Establish the RTP differential timestamp polynomial fitting model: define the serial number of the channel message as the data point on the x-axis, and the data on the y-axis as the differential value of the message timestamp, assuming that w+1 message windows in the communication process The time stamp difference sequence is counted as (d1, d2, ..., dW) (w≥1), thus the set of points to be fitted is P={i, di;)|i=1, 2, ..., w; w≥1}, P is the set of the sequence number of the message and the time difference sequence sent by the message, and then use the polynomial fitting to obtain the polynomial model of the RTP time stamp difference between the channels; ② Select and extract the clustering features of the model results obtained in step ①: use the formula

Calculate the absolute value area of the two channel fitting curves of normal c(x) and steganographic h(x), and use this as the clustering object; ③ Use clustering algorithm to judge whether there is steganography: a. Calculate the area difference {S _d } of the fitting curve of the time stamp difference sequence of w window length between the normal channels and between the normal channel and the steganographic channel respectively; b. Select the initial value multiple times from the clustering object {S _d }, and find the most suitable k center points as the initial value {C ₁ , C ₂ ,...C _k }; c. According to the formula

Calculate the distance R(i,k) between each remaining data point and the initial center point, and classify the data points closest to the center point into the cluster represented by the center point; d. Use the formula

Calculate the central point of each cluster, where N _k represents the number of data points in the cluster C _k ; S _di represents all the data points in the cluster C _k ; e. Repeat steps c and d until the error square sum criterion function starts to converge, that is, the value of the cluster center does not change anymore, and the cluster center point μ _k of each cluster of the data source and each data source to each cluster center are obtained The distance R _k ; f. According to the formula

Calculate the mean value of the distance R _k from each data source to each cluster center μ _k , wherein, i=1, 2,..., n, N _k represents the number of cluster μ _k central points; g. Compare the M of the data point to be compared with the M of the normal data point. If there is no change, it is a normal channel, and if there is a change, it is a covert channel. 2. the detection method of a kind of network storage type hidden channel as claimed in claim 1, it is characterized in that, described step 1. the polynomial fitting method in is the least squares method, promptly suppose measured time stamp difference number sequence data as {d _k }(k=1,2,3,...,w), w is the number of window data points, using a polynomial function

Represents the fitting function, then:

where j=0,1,3,...,k,

is the estimated value of d _k , the square of the distance between the observation point and the estimated point is

The weighted sum of squares of the residual E _k of the fitting model and the actual observation value at each point is minimized, that is

The value reaches the minimum, in order to obtain the parameter value. 3. The detection method of a network storage type covert channel as claimed in claim 1, characterized in that the number of polynomial fittings in the step ① is 3-7 times, preferably 5 times.

Images