Host fingerprint-based anonymous network hiding service tracing method

Abstract

The present invention provides a host fingerprint-based anonymous network hiding service tracing method comprising the steps of: 1) building a host fingerprint information base of a global IPv4 address space, wherein the fingerprint information of each host is identified by the union of fingerprint information of all the network services running on the host; 2) extracting fingerprint information of an anonymous network hiding service open port, wherein fingerprint information of each anonymous network hiding service is identified by the union of fingerprint information of all ports which are opened by the hidden service; and 3) matching fingerprint information of the extracted anonymous network hiding service in the host fingerprint information base of the global IPv4 address space to achieve anonymous network hidden service traceability. This method enhances the efficiency of hiding service traceability of anonymous networks and at the same time can be widely used to combat criminal activities that use anonymous networks.

Description

technical field [0001] The invention relates to the source tracing direction of network attacks in the field of information security, in particular to a method for tracing the source of anonymous network hidden services based on host fingerprints. Background technique [0002] As a major privacy-enhancing technology, anonymous communication technology is widely used in all aspects of the Internet. The existing anonymous communication technology mainly uses multiple store and forward (using Mix network and onion routing technology) to change the appearance of messages (packet Delay, out-of-order, message filling, etc.), and use the refresh mechanism of the Mix network to eliminate the correspondence between messages, thereby providing privacy protection for online users. Typical low-latency anonymous communication systems include Tor, I2P, etc. [0003] These anonymous communication systems not only protect the identity information of Internet users, but also protect the iden...

AI Technical Summary

Problems solved by technology

The anonymity cracking technology based on active and passive flow analysis requires the attacker to control the entry node (EntryGuard) of the anonymous network link at the same time, so as to monitor Internet users entering the entry node of the anonymous network and the entry node of the hidden service, and then use the time and The method of correlating packet size characteristics, although this method has high accuracy, the probability of an attacker being able to control the entry and exit nodes of an anonymous network at the same time is very low, and the protocol vulnerability method is often fixed by developers

Images