A time-type network covert channel detection method based on CNN image classification

Abstract

The application discloses a time type network hidden channel detection method based on CNN image classification, and the method is as follows: first, information contained in traffic generated by an observed network channel is converted into pixel values of a color image; then, a convolutional neural network is used to classify the obtained image, so that a classification detection model is obtained; finally, data extracted from a channel to be detected is classified, so that a classification result is obtained. The application improves the detection efficiency of the time type network hidden channel detection algorithm, enhances the practicability of the time type network hidden channel detection algorithm, and can effectively detect various types of time type network hidden channels.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a time-type network covert channel detection method based on CNN image classification. BACKGROUND

[0002] Information hiding is a new information security technology, which has been rapidly developed in recent years and can be widely applied to the fields of copyright protection, authentication, covert transmission of confidential information and the like. Information hiding technology is to embed hidden information into ordinary information by using the redundancy of carrier information, and to send secret information through the sending of ordinary information. Information hiding can penetrate network security facilities such as access control, firewall and intrusion detection, and implement hidden communication which is not easy to be detected. Traditional information hiding mostly takes text, audio and image as carriers. In recent years, network protocol-based information hiding has gradually become a hot spot. By using information hiding technology, for example, embedding confidential data in TCP / IP protocol to carry out covert communication, the channel is called network covert channel. The various message structures of TCP / IP protocol usually have a fixed format, which brings convenience to internetworking, but also inevitably introduces redundancy. For example, the fields in some protocol messages are usually not used in the general communication process, but they are indispensable according to the standard of TCP / IP protocol, which creates an opportunity for covert communication.

[0003] The existing network covert channel is mainly divided into storage-type covert channel and time-type covert channel. The storage-type covert channel hides information by using the redundant fields of the protocol header, such as the covert channel based on the TCP / IP header domain, the covert channel based on the checksum, the covert channel based on the timestamp in the option field, and the like. The time-type covert channel hides information by using the time sequence characteristics or order of data packets (modulating the time interval of data packets, the sending time of data packets in the network or the order of data packets, etc.), such as the On-Off type time covert channel, the L-N type network time covert channel, the Jitterbug type network time covert channel and the Time Replay type time covert channel.

[0004] The existence of covert channels on the internet poses a significant threat to the information security of nations, organizations, and individuals. In particular, some viruses on the internet have begun to be transmitted through covert channels, and information belonging to nations, businesses, and individuals is also being leaked to adversaries or other networks through these channels. Currently, the disruption of network security by covert channels is silent and insidious, posing a substantial threat to the security and privacy of network information. Therefore, research into detection technologies for covert channels on the internet is imperative.

[0005] Compared to forward research on covert channels, research on inverse detection techniques is relatively limited. Existing time-based covert channel detection methods mostly analyze specific concealment algorithms, such as statistical detection methods that extract statistical attributes of covert and overt traffic. These methods suffer from low detection efficiency and limited practicality. Furthermore, using machine learning methods for detection requires extracting feature vectors, and the different feature vectors of different types of channels significantly impact the efficiency of the detection method. Summary of the Invention

[0006] The purpose of this invention is to provide a time-based network covert channel detection method that is highly efficient, practical, and effective against various time-based covert network shielding channels.

[0007] The technical solution to achieve the purpose of this invention is: a method for detecting hidden channels in a temporal network based on CNN image classification, comprising the following steps:

[0008] Step 1: Convert the information contained in the traffic generated by the observed network channel into pixel values ​​of a color image;

[0009] Step 2: Use a convolutional neural network to classify the obtained images to obtain a classification and detection model;

[0010] Step 3: Classify the data extracted from the channel to be detected and obtain the classification results.

[0011] Furthermore, the process of converting the information contained in the observed network channel traffic into pixel values ​​of a color image, as described in step 1, is as follows:

[0012] For normal training samples, the arrival interval t of each data packet is captured and sequentially placed into a 16×16 matrix. The arrival interval in each matrix is ​​converted into a range of 0 to 255 representing pixel values, and an image is created based on this matrix. For abnormal training samples, data processing is performed in the same way as for normal training samples.

[0013] Further, the arrival interval time t of each data packet is sequentially placed into a 16x16 matrix, and the arrival interval time in each matrix is converted into a range of 0 to 255 representing pixel values, specifically as follows:

[0014] After continuously capturing N data packet arrival interval times t, for N≥256 values, 256 values are placed from left to right in a 16x16 matrix row by row, and for N<256 values, N values are sequentially placed into a 16x16 matrix, and the remaining is filled with 0.

[0015] Further, the image is created according to this matrix, specifically as follows:

[0016] The values in the matrix of the normal training sample are normalized to a range of 0 to 255 representing image pixel values, and the normalized matrix is converted to obtain an image.

[0017] Further, for abnormal training samples, data processing is performed in the same way as normal training samples, specifically as follows:

[0018] The values in the matrix of the abnormal training sample are normalized to a range of 0 to 255 representing image pixel values, and the normalized matrix is converted to obtain an image.

[0019] Further, the image obtained is classified and processed using a convolutional neural network according to step 2 to obtain a classification detection model, specifically as follows:

[0020] The image data of the normal training sample and the image data of the abnormal training sample obtained in step 1 are classified and trained to obtain a classification detection model.

[0021] Further, the image data of the normal training sample and the image data of the abnormal training sample obtained in step 1 are classified and trained, specifically as follows:

[0022] The CNN classification model is used to train the obtained image data of the normal training sample and the image data of the abnormal training sample to obtain classification model features, thereby constructing a classification detection model.

[0023] Further, the data extracted from the channel to be detected in step 3 is classified to obtain a classification result, specifically as follows:

[0024] For the communication channel to be detected, after data extraction according to the method of step 1, the data extracted from the channel to be detected is classified according to the classification detection model obtained by training, to obtain a classification result, i.e., to detect whether it contains a hidden channel.

[0025] Further, before channel detection in step 3, data processing according to step 1 is needed, and a classification result is obtained by using a detection model for classification, so as to obtain a detection result.

[0026] Further, data processing according to step 1 in step 3 is as follows:

[0027] After continuously capturing N test sample data packets with an interval time t, for N >= 256, 256 values are taken from left to right and put into a 16x16 matrix row by row, and for N < 256, N values are sequentially put into a 16x16 matrix, and the rest are filled with 0; the values in the test sample matrix are normalized to represent the image pixel values in the range of 0 to 255, and the normalized matrix is converted to obtain an image.

[0028] Compared with the prior art, the present application has the following advantages: (1) it can detect various types of time-type network covert channels, and is not limited to the detection of a certain type of time-type network covert channel, and has strong applicability; (2) the use of deep learning method improves the detection efficiency and accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 The figure is a flowchart of the time-type network covert channel detection method based on CNN image classification of the present application.

[0030] Figure 2 The figure is a flowchart of the detection of the to-be-detected channel by using the detection model in the present application. DETAILED DESCRIPTION

[0031] The present application will be further described in detail below in combination with the drawings and specific embodiments.

[0032] The time-type network covert channel detection method based on CNN image classification of the present application includes two parts of training and testing, wherein the training stage mainly includes data processing and model training.

[0033] In combination with Figure 1 The time-type network covert channel detection method based on CNN image classification of the present application includes the following steps:

[0034] Step 1: convert the information contained in the observed network channel traffic into pixel values of a color image, which is as follows:

[0035] For all data samples, first capture the time interval t of each data packet arrival, put the arrival time interval t of each data stream from left to right into a 16x16 matrix in turn, normalize the values in the matrix to represent the range of 0 to 255 of image pixel values, then create the matrix into an image through the matplotlib library, and the matrix representing the image is the sample data, and then the sample data is processed further.

[0036] Further, the capture of the interval time t of each data packet arrival in step 1, the arrival interval time t is put into a 16x16 matrix in turn, and the arrival interval time in each matrix is converted to the range of 0 to 255 representing the pixel value, as follows:

[0037] After continuously capturing the arrival interval time t of N data packets, for N≥256 values, take 256 values from left to right and put them into a 16x16 matrix row by row, and for N<256 values, put N values into a 16x16 matrix in turn, and the rest is filled with 0.

[0038] Further, the image created according to the matrix in step 1, as follows:

[0039] The values in the matrix of the normal training sample are normalized to represent the range of 0 to 255 of image pixel values, and the image is obtained after converting the normalized matrix.

[0040] Further, for the abnormal training sample, the same method as the normal training sample is used for data processing, as follows:

[0041] The values in the matrix of the abnormal training sample are normalized to represent the range of 0 to 255 of image pixel values, and the image is obtained after converting the normalized matrix.

[0042] Step 2, use the convolutional neural network to classify the obtained image, and get the classification detection model, as follows:

[0043] The training sample is divided into normal training sample and abnormal training sample, LeNet-5 model is used, different size of convolution kernel is used in convolution layer, and maximum pooling is used for training the sample, and the classification detection model Model is obtained.

[0044] Further, the image data of the normal training sample and the image data of the abnormal training sample obtained in step 1 are classified and trained in step 2, as follows:

[0045] The CNN classification model is used to train the obtained image data of normal training samples and image data of abnormal training samples, and a classification model feature is obtained, so as to construct a classification detection model.

[0046] Step 3, the data extracted from the channel to be detected is classified to obtain a classification result, and the specific process is as follows:

[0047] According to the classification model Model obtained in the training stage, the test sample is classified to obtain a classification test result, and the effect of the classification model Model is checked according to the false alarm rate, the false alarm rate and the accuracy.

[0048] Further, before the channel detection in step 3, data processing according to step 1 is required, and a classification result is obtained by using the detection model for classification, so as to obtain a detection result.

[0049] Further, the data processing according to step 1 in step 3 is as follows:

[0050] After the interval time t of the continuous capture of N test sample data packets, for N >= 256 values, 256 values are put from left to right into a 16x16 matrix, and for N < 256 values, N values are put into a 16x16 matrix in turn, and the rest is filled with 0; the values in the matrix of the test sample are normalized to represent the image pixel value in the range of 0 to 255, and the normalized matrix is converted to obtain an image.

[0051] Further, in combination with Figure 2 Step 3, the data extracted from the channel to be detected is classified to obtain a classification result, and the specific process is as follows:

[0052] Step 3.1, data processing: for the network channel to be detected, the time interval of the communication channel data packet is captured, and the data is processed according to the processing method in the model training to obtain the processed data;

[0053] Step 3.2, classification detection: using the obtained CNN classification detection model to classify and detect the data to obtain a classification result, i.e., a detection result;

[0054] Step 3.3, detection result: according to the detection result, it is judged whether there is a time type network hidden channel in the channel.

[0055] The present application can detect various types of time type network hidden channels, and is not limited to the channel detection of a certain type of time type network hidden channel, and has strong applicability; at the same time, the deep learning method is used to improve the detection efficiency and accuracy.

Claims

1. A time-based network covert channel detection method based on CNN image classification, characterized in that, It comprises the following steps: Step 1, converting the information contained in the observed network channel generated traffic into pixel values of a color image; Step 2, classifying the obtained image using a convolutional neural network to obtain a classification detection model; Step 3, classifying the extracted data of the to-be-detected channel to obtain a classification result; Step 1, converting the information contained in the observed network channel generated traffic into pixel values of a color image, specifically as follows: For normal training samples, capture the inter-arrival time t of each data packet, put the inter-arrival time t into a 16x16 matrix in turn, convert the inter-arrival time in each matrix into a range of 0 to 255 representing pixel values, and create an image according to the matrix; for abnormal training samples, data processing is performed in the same way as normal training samples; The inter-arrival time t of each data packet is captured, and the inter-arrival time t is put into a 16x16 matrix in turn, and the inter-arrival time in each matrix is converted into a range of 0 to 255 representing pixel values, specifically as follows: After continuously capturing N data packet inter-arrival times t, for N≥256 values, take 256 values from left to right and put them into a 16x16 matrix row by row, and for N<256 values, put N values into a 16x16 matrix in turn, and fill the rest with 0.

2. The CNN image classification based steganographic channel detection method of claim 1, wherein, The image is created according to the matrix, specifically as follows: The values in the matrix of normal training samples are normalized to a range of 0 to 255 representing image pixel values, and the normalized matrix is converted to obtain an image.

3. The CNN image classification based steganographic detection of temporal network method according to claim 1, wherein, For abnormal training samples, data processing is performed in the same way as normal training samples, specifically as follows: The values in the matrix of abnormal training samples are normalized to a range of 0 to 255 representing image pixel values, and the normalized matrix is converted to obtain an image.

4. The CNN image classification based steganographic detection of temporal network according to claim 1, wherein, Step 2, classifying the obtained image using a convolutional neural network to obtain a classification detection model, specifically as follows: The normal training sample image data and abnormal training sample image data obtained in step 1 are classified and trained to obtain a classification detection model.

5. The CNN image classification based steganographic detection of temporal network method according to claim 4, characterized in that, The normal training sample image data and abnormal training sample image data obtained in step 1 are classified and trained, specifically as follows: Using the CNN classification model, the obtained normal training sample image data and abnormal training sample image data are trained to obtain classification model features, thereby constructing a classification detection model.

6. The CNN image classification based steganographic detection of temporal network according to claim 1, wherein, In step 3, the data extracted from the to-be-detected channel is classified to obtain a classification result, specifically as follows: For the to-be-detected communication channel, after data extraction according to the method of step 1, the data extracted from the to-be-detected channel is classified according to the classification detection model obtained by training, and a classification result is obtained, that is, whether it contains a hidden channel is detected.

7. The CNN image classification based steganographic detection of temporal network method according to claim 6, characterized in that, Before channel detection in step 3, data processing according to step 1 is required, and classification is performed using the detection model to obtain a classification result, thereby obtaining a detection result.

8. The CNN image classification based steganographic detection of temporal network method according to claim 7, characterized in that, In step 3, data processing according to step 1 is performed, specifically as follows: After the N test sample data packets are continuously captured, the interval time t is obtained, and for N≥256, the 256 values are arranged from left to right in a 16×16 matrix, and for N<256, the N values are sequentially arranged in a 16×16 matrix, and the remaining is filled with 0; the values in the test sample matrix are normalized to represent the image pixel value in the range of 0 to 255, and the normalized matrix is converted to obtain an image.

Images