A Tor relay node vulnerability assessment method based on ecological vulnerability graph

Abstract

The present invention discloses a Tor relay node vulnerability assessment method based on an ecological vulnerability graph. The method includes: deploying relay nodes, and monitoring and recording network links existing in the Tor network in real time based on the Tor control protocol, and constructing an undirected network connection graph G; crawling the relay node server descriptor published by Tor Metric; using the asset mapping platform and vulnerability scanning tool to obtain server asset security attribute information, and using the weighted scoring rule to calculate the attribute vulnerability score; using the network connection graph, server descriptor information, asset security attribute information, and relay node attribute vulnerability score to construct a Tor network ecological vulnerability graph VG; using weighted centrality measurement and graph convolution network algorithm to measure the structural vulnerability of the relay nodes of the Tor network ecological vulnerability graph, and calculating the comprehensive vulnerability score of the relay nodes; the present invention constructs a Tor relay node vulnerability assessment theory based on the ecological vulnerability graph, combines the relay node attribute characteristics and network connection characteristics, and respectively uses the weighted calculation rule and centrality measurement method to calculate the central node attribute vulnerability and structural vulnerability, so as to realize the Tor relay node to perform comprehensive vulnerability assessment.

Description

Technical Field

[0001] The present invention relates to a network relay node vulnerability assessment technology, belonging to the technical field of computer security and anonymous network, and in particular to a Tor relay node vulnerability assessment method based on an ecological vulnerability graph. Background Art

[0002] With the popularization of the Internet and the development of anonymous communication technology, network users pay more and more attention to personal privacy and communication security. Although traditional cryptography technology can guarantee the confidentiality and integrity of data to a certain extent, it cannot effectively hide the identity information carried by users during communication. Therefore, in order to protect user privacy, anonymous communication technology came into being. Its core idea is to avoid direct connection between users and servers through multiple relay node forwarding technology, thereby ensuring the anonymity of user identities to a certain extent.

[0003] The Onion Router (Tor) is a representative anonymous communication network. Its core technology is to encrypt and package messages layer by layer into onion-like data packets, and forward them through a series of network relay nodes. Each time it passes through a network relay node, the outermost layer of the data packet will be decrypted until the last layer is decrypted at the destination and the original message is obtained. This series of encrypted packaging allows each network relay node (including the destination) to only know the location of the previous relay node, but not the entire sending path and the address of the original sender, thereby hiding the user's identity information. However, it is precisely because of its excellent anonymity that the Tor network has also become a hotbed for criminals to carry out illegal activities, posing a huge challenge to network law enforcement agencies.

[0004] When facing the anonymous tracking and tracing problem in the Tor network, both the flow correlation analysis technology and the data packet marking scheme must be implemented under the premise that the relay nodes are controllable, so there is a need to evaluate the vulnerability of Tor relay nodes. By borrowing the concept of ecological vulnerability graph, a relay node vulnerability assessment method suitable for the Tor network can be established, so as to better identify and control vulnerable relay nodes in the Tor network, thereby achieving deanonymization based on controllable entry and exit relay nodes, and finally achieving end-to-end correlation tracking and tracing of the dark web under the condition of partially controllable relay nodes. Summary of the invention

[0005] In view of this, the present invention provides a Tor relay node vulnerability assessment method based on an ecological vulnerability graph, aiming to construct a Tor network ecological vulnerability graph to realize vulnerability assessment of Tor relay nodes, and further provide an effective solution for relevant departments to control vulnerable relay nodes and realize anonymous network tracking and tracing.

[0006] A Tor relay node vulnerability assessment method based on an ecological vulnerability graph, the method comprising:

[0007] S100. According to the Tor Project relay node deployment document, deploy a certain number of relay nodes in the Tor network, and monitor and record the network links in the Tor network in real time based on the Tor control protocol, and build an undirected network connection graph G;

[0008] S200. Crawl the relay node server descriptors published by Tor Metric, organize the IP addresses of all relay nodes into a relay node IP list for subsequent scanning and analysis, and save some information for subsequent mapping;

[0009] S300. Based on the relay node IP list in step S200, the existing network public asset mapping platform and vulnerability scanning tools are used to obtain detailed asset security attribute information of the server corresponding to each relay node IP, and the attribute vulnerability score of each relay node is calculated using the weighted scoring rule;

[0010] S400. Based on step S100, step S200 and step S300, a Tor network ecological vulnerability graph VG is constructed using the network connectivity graph G, server descriptor information, asset security attribute information and relay node attribute vulnerability scores;

[0011] S500. Based on step S400, the structural vulnerability of the relay nodes of the Tor network ecological vulnerability graph is measured using the weighted centrality measurement algorithm and the graph convolutional network algorithm, and the comprehensive vulnerability score of the relay nodes is calculated;

[0012] Further, in step S100, step S100 is specifically:

[0013] The relay node refers to a volunteer server participating in the Tor network, which is mainly responsible for transmitting and encrypting the user's communication data;

[0014] The Tor Control Protocol is a protocol provided by Tor for other programs to communicate with the locally running Tor process, and does not belong to the Tor onion routing protocol;

[0015] The network connectivity graph is an undirected graph G with relay node IP addresses as relay nodes and relay node link connection relationships as edges;

[0016] S110. Determine the type of relay node to be deployed. The selectable relay node types include entry relay node, intermediate relay node and exit relay node;

[0017] S120. Select the corresponding method to set up a new Tor relay node according to the server platform type supported by Tor;

[0018] S130. Based on the Tor control protocol, connect to the Tor process through a socket and send a new link instruction to operate the Tor client, and receive the link connection information returned after the instruction is executed;

[0019] S140. Repeat the above step S130, continuously obtain new link connection information, and generate a network connectivity graph G according to the method of <relay node IP, relay node IP, link connection>.

[0020] Further, in step S200, step S200 is specifically:

[0021] Tor Metric is a public data platform provided by the Tor project, which aims to collect, analyze and display various statistics and performance data of the Tor network;

[0022] The relay node server descriptor is a description file provided by the relay node and contains an IP address and other basic information of the relay node.

[0023] Further, in step S300, step S300 is specifically:

[0024] The public network asset mapping platform is a tool for discovering, identifying and managing all publicly visible assets of an organization on the Internet, including DayDayMap, UniCSM, 360 or HUNTER;

[0025] The vulnerability scanning tool is a security tool used to detect security vulnerabilities in computer systems, networks and applications, including OpenVAS or Nessus;

[0026] The asset security attribute information is used to describe the security characteristics and status of the asset, including the name of the operating system, whether it is an IoT device, open ports, firewall or CDN, regional information, component quantity and version number, web response status code, web response header information and vulnerability information, a total of 9 types;

[0027] S310. Using the public asset mapping platform and vulnerability scanning tools, obtain the asset security attribute information of the server corresponding to each relay node IP in the relay node IP list;

[0028] S320. Score each security attribute according to a predefined weighted scoring rule;

[0029] S330. Weight each security attribute information and calculate the attribute vulnerability score S of each relay node Attr , the formula is as follows:

[0030]

[0031] Among them, S Attr Score the vulnerability of the desired attribute, w i The weight corresponding to each security attribute, s i The score corresponding to each security attribute.

[0032] Further, in step S310, step S310 includes the following steps:

[0033] S311. Use the public asset mapping platform to query the IP in the relay node IP list to obtain the operating system name of the server corresponding to each relay node IP, whether it is an IoT device, open ports, firewall or CDN, regional information, component quantity and version number, web response status code and web response header information;

[0034] S312. Use a vulnerability scanning tool to scan the IPs in the relay node IP list to obtain vulnerability information of the server corresponding to each relay node IP.

[0035] Further, in step S400, step S400 is specifically:

[0036] S410. Based on step S100 and step S200, on the basis of the network connection graph G, an edge relationship <relay node IP, relay node IP, same server descriptor> is added to the relay nodes with the same server descriptor to generate a graph G', wherein the same server descriptor includes two types: operator contact information and family information;

[0037] S420. Based on step 410 and step 300, in graph G', an edge relationship <relay node IP, relay node IP, same asset security attribute information symbol> is added to the relay nodes with the same asset security attribute information to generate graph G'', wherein the same asset security attribute information is the location, state / province and country included in the geographical information;

[0038] S430. Based on step 420, add different weights to different types of edge relationships in graph G”;

[0039] S440. Based on step S100 and step S300, add the attribute vulnerability score as the relay node attribute for each relay node in graph G”, and finally construct the Tor network ecological vulnerability graph VG.

[0040] Further, in step 430, step S430 includes the following steps:

[0041] S431. Add a weight of 0.4 to <relay node IP, relay node IP, link connection> in Figure G”;

[0042] S432. Add a weight of 0.3 to <relay node IP, relay node IP, same server descriptor> in Figure G”;

[0043] S433. Add a weight of 0.3 to <relay node IP, relay node IP, same asset security attribute information> in Figure G”.

[0044] S500. Based on step 400, the structural vulnerability of the relay nodes of the Tor network ecological vulnerability graph is measured using the weighted centrality measurement algorithm and the graph convolutional network algorithm, and the comprehensive vulnerability score of the relay nodes is calculated;

[0045] Further, in step S500, step S500 is specifically:

[0046] S510. Using a variety of weighted centrality measurement algorithms, perform centrality measurement on each relay node in the Tor network ecological vulnerability graph VG and obtain the centrality measurement score S Cent , the weighted centrality measurement algorithms include weighted degree centrality, weighted betweenness centrality, weighted closeness centrality and weighted PageRank score;

[0047] S520. Use the graph convolutional network to normalize each relay node in the graph and use the L2 norm to calculate the vector Euclidean length S L2 ;

[0048] S530. Using attribute vulnerability score S Attr , the centrality measure score S Cent , Euclidean length S L2 Perform weighted summation to calculate the comprehensive vulnerability score S of each relay node V , the formula is as follows:

[0049] S V =0.5*S Attr +0.3*S Cent +0.2*S L2

[0050] Further, in step S510, step S510 includes the following steps:

[0051] S511. Calculate weighted centrality for each relay node The formula is as follows:

[0052]

[0053] Where N(v) is the set of nodes connected to node v, w uv is the weight of the edge from node u to node v;

[0054] S512. Calculate the betweenness centrality for each relay node The formula is as follows:

[0055]

[0056] Among them, σ st is the number of shortest paths between nodes s and t, σ st (v) is the number of shortest paths between nodes s and t that pass through node v;

[0057] S513. Calculate the proximity centrality for each relay node The formula is as follows:

[0058]

[0059] Among them, d w (u,v) is the weight of the shortest path from node u to v;

[0060] S514. Calculate PageRank score PR for each relay node w (v), the formula is as follows:

[0061]

[0062] Where N is the total number of nodes in the graph, d is the damping factor in the PageRank score, and w uv is the weight of the edge from node u to node v, and Neighbors(v) is the set of nodes connected to node v;

[0063] S515. Normalize the multiple weighted centrality metrics of the relay nodes respectively, and calculate their average value as the relay node centrality metric score. The normalization formula is as follows:

[0064]

[0065] Among them, x represents a certain type of weighted centrality measurement score of a pair of relay nodes, and X represents a certain type of weighted centrality measurement score set for all relay nodes.

[0066] Further, in step S520, step S520 includes the following steps:

[0067] S521. Using the graph convolutional network, embed each relay node in the Tor network ecological vulnerability graph VG and obtain a normalized vector representation;

[0068] S522. Use the L2 norm to calculate the vector Euclidean length ||x||2, the formula is as follows:

[0069]

[0070] Where x is a binary number containing n elements x1, x2, …, x n Vector. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A flow chart of the Tor relay node vulnerability assessment technology based on the ecological vulnerability graph provided by the present invention;

[0072] Figure 2 The present invention provides a predefined weighted scoring rule for calculating the relay node attribute vulnerability score;

[0073] Figure 3 Provide a flow chart for constructing a Tor network ecological vulnerability graph VG for the present invention;

[0074] Figure 4 A sample diagram of an embodiment of the present invention for structural vulnerability measurement is provided;

[0075] Figure 5 A flow chart for calculating a comprehensive vulnerability score of a relay node is provided for the present invention. DETAILED DESCRIPTION

[0076] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementations. The following examples or drawings are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0077] See also Figure 1 , Figure 1 The flowchart of the Tor relay node vulnerability assessment method provided in the embodiment of the present application includes:

[0078] S100. According to the Tor Project relay node deployment document, deploy a certain number of relay nodes in the Tor network, and monitor and record the network links existing in the Tor network in real time based on the Tor control protocol to build an undirected network connection graph G.

[0079] In one embodiment, the step S100 includes the following steps:

[0080] S110. Determine the type of relay node to be deployed. The selectable relay node types include entry relay node, intermediate relay node and exit relay node. The relay node refers to a volunteer server participating in the Tor network, which is mainly responsible for transmitting and encrypting the user's communication data.

[0081] S120. Select the corresponding method to set up a new Tor relay node according to the server platform type supported by Tor;

[0082] For example: the server platform types supported by Tor include Arch Linux, CentOS / RHEL, Debian / Ubuntu, DragonFlyBSD, Fedora, FreeBSD, NetBSD, OpenBSD, Void Linux and Windows.

[0083] S130. Based on the Tor control protocol, connect to the Tor process through a socket and send a new link instruction to operate the Tor client, and receive the link connection information returned after the instruction is executed; the Tor control protocol is a protocol provided by Tor for other programs to communicate with the locally running Tor process, and does not belong to the Tor onion routing protocol;

[0084] For example: Stem is a Tor control library developed in Python that allows users to interact with the Tor control protocol to control the Tor process. When a user establishes a connection with a Tor client, he or she can send a command to generate a new link to the Tor process. After the Tor process responds to the command to generate a new link, it will return the corresponding link information, including the relay node IP address and port number.

[0085] S140. Repeat the above step S130, continuously obtain new link connection information, and generate a network connection graph G according to the method of <relay node IP, relay node IP, link connection>; the network connection graph is an undirected graph G with relay node IP addresses as relay nodes and relay node link connection relationships as edges;

[0086] For example: when the user receives a link information "185.220.100.248->10.8.24.121->185.220.100.244" returned, it contains three graph nodes and two edges, and the edge relationships are <185.220.100.248, 10.8.24.121, link connection> and <10.8.24.121, 185.220.100.244, link connection>; when the user receives enough link information, the network connectivity graph G can be constructed.

[0087] S200. Crawl the relay node server descriptors published by Tor Metric, organize the IP addresses of all relay nodes into a relay node IP list for subsequent scanning and analysis, and save some other information for subsequent mapping.

[0088] Specifically, the Tor Metric is a public data platform provided by the Tor project, which is designed to collect, analyze and display various statistics and performance data of the Tor network. The relay node server descriptor is a description file provided by the relay node that contains an IP address and other basic information about itself.

[0089] For example, a complete relay node server descriptor specifically includes the descriptor type and version number, type, nickname, IP address, port number, Ed25519 algorithm master key, Tor software version and operating platform of each relay node. Tor protocol characteristics, release time, fingerprint, running time, bandwidth information, additional information summary, whether it acts as a hidden service directory, operator contact information, bridge node distribution request, NTor Onion key, rejection rules, whether it supports tunnel directory servers and node summary; the attributes used for subsequent composition are operator contact information and family information.

[0090] S300. Based on the relay node IP list in step S200, use the existing network public asset mapping platform and vulnerability scanning tools to obtain detailed asset security attribute information of the server corresponding to each relay node IP, and use the weighted scoring rules to calculate the attribute vulnerability score of each relay node.

[0091] In one embodiment, the step S300 includes the following steps:

[0092] S310. Using the public asset mapping platform and vulnerability scanning tools, obtain the asset security attribute information of the server corresponding to each relay node IP in the relay node IP list;

[0093] Further, in step S310, step S310 includes the following steps:

[0094] S311. Use the public asset mapping platform to query the IP in the relay node IP list to obtain the operating system name of the server corresponding to each relay node IP, whether it is an IoT device, open ports, firewall or CDN, regional information, component quantity and version number, web response status code and web response header information;

[0095] The regional information specifically includes location, state / province, and country, and the web response header information includes location, powered-by, product, server, set-cookie, authenticate, x-app-name, x-aspnet-version, x-aspnetmvc-version, x-generator, powered-cms, and x-served-by;

[0096] For example, a relay node IP is "193.35.18.49". The specific security attribute information can be obtained through the asset mapping platform, including the operating system name [Linux Ubuntu 18.04], whether it is an IoT device [No], open ports [80,9001], firewall or CDN [No], regional information [Limburg an der Lahn, Hessen, Germany], component quantity and version number [2, Apache 2.4.41, Tor 0.3.1.1], web response status code

[500] , and web response header information [Empty].

[0097] S312. Use vulnerability scanning tools to scan the IPs in the relay node IP list to obtain vulnerability information of the server corresponding to each relay node IP;

[0098] The vulnerability information specifically includes the CVE number and CVSS score of the vulnerability;

[0099] For example: A relay node IP is "193.35.18.49". After scanning with a vulnerability scanning tool, its specific vulnerability information can be obtained, including the vulnerability CVE number name [CVE-2021-26855] and the vulnerability CVSS score [9.8].

[0100] S320. Score each security attribute according to predefined scoring rules;

[0101] The predefined weighted scoring rule is as follows: Figure 2 As shown;

[0102] For example, a relay node IP is "193.35.18.49". According to the predefined scoring rules, the operating system is scored 10 points, whether it is an IoT device is 5 points, open ports are 5 points, firewall or CDN is 10 points, regional information is 0 points, component quantity and version number are 10 points, web response status code is 10 points, web response header information is 10 points, and vulnerability information is 10 points.

[0103] S330. Weight each security attribute information and calculate the attribute vulnerability score S of each relay node Attr , the formula is as follows:

[0104]

[0105] Among them, S Attr Score the vulnerability of the desired attribute, w i The weight corresponding to each security attribute, s iScores corresponding to each security attribute. The weighting rules are as follows: the weight of the operating system is 0.1, the weight of whether it is an Internet of Things device is 0.1, the weight of open ports is 0.1, the weight of the firewall or CDN is 0.15, the weight of geographical information is 0.1, the weight of the number of components and version numbers is 0.1, the weight of the web response status code is 0.05, the weight of the web response header information is 0.05, and the weight of vulnerability information is 0.25;

[0106] For example: The IP of a relay node is "193.35.18.49", and its attribute vulnerability score S can be obtained through the weighted rule scoring Attr = 0.1 * 10 + 0.1 * 5 + 0.1 * 5 + 0.15 * 10 + 0.1 * 0 + 0.1 * 10 + 0.05 * 10 + 0.05 * 10 + 0.25 * 10 = 8.

[0107] S400. Based on step S100, step S200, and step S300, use the network connectivity graph G, server descriptor information, asset security attribute information, and relay node attribute vulnerability score to construct the Tor network ecosystem vulnerability graph VG.

[0108] In one embodiment, as Figure 3 shown, the Figure 3 is a schematic flow diagram for constructing the Tor network ecosystem vulnerability graph VG, and step S400 includes the following steps:

[0109] S410. Based on step S100 and step S200, on the basis of the network connectivity graph G, add an edge relationship <relay node IP, relay node IP, same server descriptor> for relay nodes with the same server descriptor to generate graph G'. The same server descriptor includes two types: operator contact information and family information;

[0110] For example: Two relay nodes V1 and V2 have the same operator contact information "Fabian Keil<fk@fabiankeil.de>8BA2371C" and family information "40A60D1F1E8AFBED22FCB30B3FBE2E275A14CF99, 5CE3AD8AD 04ADE66C0037A3CF5F7F7A40D48A20B, 9171101E709ADE5881F5E2CA1100D4044B44263E,". An edge <V1, V2, same server descriptor> can be added to the original network connectivity graph G to generate graph G'.

[0111] S420. Based on Step 410 and Step 300, add an edge relationship <Relay Node IP, Relay Node IP, Same Asset Security Attribute Information Symbol> for relay nodes with the same asset security attribute information in Graph G' to generate Graph G'', where the same asset security attribute information is the location, state / province, and country included in the geographical information;

[0112] For example: Two relay nodes V1 and V2 have the same location "Limburg an der Lahn", state / province "Hessen", and country "Germany". An edge <V1, V2, Same Asset Security Attribute Information> can be added based on Graph G' to generate Graph G''.

[0113] S430. Based on Step 420, add different weights to different types of edge relationships in Graph G'';

[0114] Among them, in Step 430, Step S430 includes the following steps:

[0115] S431. Add a weight of 0.4 to <Relay Node IP, Relay Node IP, Link Connection> in Graph G'';

[0116] S432. Add a weight of 0.3 to <Relay Node IP, Relay Node IP, Same Server Descriptor> in Graph G'';

[0117] S433. Add a weight of 0.3 to <Relay Node IP, Relay Node IP, Same Asset Security Attribute Information> in Graph G''.

[0118] For example: The edge relationship between relay node A and relay node B in Graph G'' is <10.8.24.121, 185.220.100.244, Same Asset Security Attribute Information>, and a weight of 0.3 should be added.

[0119] S440. Based on Step S100 and Step S300, add an attribute vulnerability score as a relay node attribute to each relay node in Graph G'', and finally construct the Tor network ecological vulnerability graph VG.

[0120] S500. Based on Step 400, use the weighted centrality measurement algorithm and the graph convolutional network algorithm to measure the structural vulnerability of the relay nodes in the Tor network ecological vulnerability graph and calculate the comprehensive vulnerability score of the relay nodes.

[0121] In one embodiment, as Figure 4 and Figure 5 shown, the Figure 4 is a sample graph for this step to measure structural vulnerability, and the Figure 5 is a flowchart for calculating the comprehensive vulnerability score of relay nodes. Step S500 includes the following steps:

[0122] S510. Using a variety of weighted centrality measurement algorithms, perform centrality measurement on each relay node in the Tor network ecological vulnerability graph VG and obtain the centrality measurement score S Cent , the weighted centrality measurement algorithms include weighted degree centrality, weighted betweenness centrality, weighted closeness centrality and weighted PageRank score;

[0123] Further, in step S510, step S510 includes the following steps:

[0124] S511. Calculate weighted centrality for each relay node The formula is as follows:

[0125]

[0126] Where N(v) is the set of nodes connected to node v, w uv is the weight of the edge between node u and node v;

[0127] For example: In the sample graph EG, relay node V2 has weighted degree centrality

[0128] S512. Calculate weighted betweenness centrality for each relay node The formula is as follows:

[0129]

[0130] Among them, σ st is the number of shortest paths between nodes s and t, σ st (v) is the number of shortest paths between nodes s and t that pass through node v;

[0131] For example: In the sample graph EG, the weighted betweenness centrality of relay node V2

[0132] S513. Calculate the proximity centrality for each relay node The formula is as follows:

[0133]

[0134] Among them, d w (u,v) is the weight of the shortest path from node u to v;

[0135] For example: In the sample graph EG, the weighted proximity centrality of relay node V2

[0136] S514. Calculate the weighted PageRank score PR for each relay node w(v), the formula is as follows:

[0137]

[0138] Where N is the total number of nodes in the graph, d is the damping factor in the PageRank score, and w uv is the weight of the edge from node u to node v, and Neighbors(v) is the set of nodes connected to node v;

[0139] For example: In the sample graph EG, the weighted PageRank score of relay node V2

[0140] S515. Normalize the multiple weighted centrality metrics of the relay nodes respectively and calculate their average value S Cent As the relay node centrality measurement score, the normalization processing formula is as follows:

[0141]

[0142] Among them, x represents a certain type of weighted centrality measurement score of a pair of relay nodes, and X represents a certain type of weighted centrality measurement score set for all relay nodes;

[0143] For example, in the sample graph EG, the normalized weighted degree centrality, weighted betweenness centrality, weighted closeness centrality and weighted PageRank score of relay node V2 are average value

[0144] S520. Use the graph convolutional network to normalize each relay node in the graph and use the L2 norm to calculate the vector Euclidean length S L2 ;

[0145] Wherein, in step S520, step S520 includes the following steps:

[0146] S521. Using the graph convolutional network, embed each relay node in the Tor network ecological vulnerability graph VG and obtain a normalized vector representation;

[0147] S522. Use the L2 norm to calculate the vector Euclidean length ||x||2, the formula is as follows:

[0148]

[0149] Where x is a binary number containing n elements x1, x2, …, x n A vector of

[0150] For example, in the sample graph EG, the normalized vector of relay node V2 is represented as [0.3, 0.3, 0.2], then its Euclidean length

[0151] S530. Using attribute vulnerability score S Attr , the centrality measure score S Cent , Euclidean length S L2 Perform weighted summation to calculate the comprehensive vulnerability score S of each relay node V , the formula is as follows:

[0152] S V =0.5*S Attr +0.3*S Cent +0.2*S L2

[0153] For example: In the sample graph EG, assume that the attribute vulnerability score of the relay node is S Attr =8, then the comprehensive vulnerability score S V =0.5*8+0.3*0.8+0.2*0.469≈4.333.

[0154] Finally, it should be noted that the above is only an embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent replacements for some of the technical features therein.

[0155] Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A Tor relay node vulnerability assessment method based on an ecological vulnerability graph, characterized in that: The following steps are involved: S100. According to the Tor Project relay node deployment document, deploy a certain number of relay nodes in the Tor network, and monitor and record the network links in the Tor network in real time based on the Tor control protocol, and build an undirected network connection graph G; The relay node refers to a volunteer server participating in the Tor network, which is mainly responsible for transmitting and encrypting the user's communication data; the Tor control protocol is a protocol provided by Tor for other programs to communicate with the locally running Tor process, and does not belong to the Tor onion routing protocol; the network connection graph is an undirected graph G with the relay node IP address as the relay node and the relay node link connection relationship as the edge; S200. Crawl the relay node server descriptors published by Tor Metric, organize the IP addresses of all relay nodes into a relay node IP list for subsequent scanning and analysis, and save some information for subsequent mapping; The Tor Metric is a public data platform provided by the Tor project, which is designed to collect, analyze and display various statistics and performance data of the Tor network; the relay node server descriptor is a description file provided by the relay node that contains the IP address and other basic information of the relay node; S300. Based on the relay node IP list in step S200, the existing network public asset mapping platform and vulnerability scanning tools are used to obtain detailed asset security attribute information of the server corresponding to each relay node IP, and the attribute vulnerability score of each relay node is calculated using the weighted scoring rule; Among them, the public network asset mapping platform is a tool for discovering, identifying and managing all publicly visible assets of an organization on the Internet, including DayDayMap, UniCSM, 360 or HUNTER; the vulnerability scanning tool is a security tool for detecting security vulnerabilities in computer systems, networks and applications, including OpenVAS or Nessus; the asset security attribute information is information used to describe the security characteristics and status of assets, including operating system name, whether it is an IoT device, open ports, firewall or CDN, regional information, component quantity and version number, web response status code, web response header information and vulnerability information, a total of 9 types; S400. Based on step S100, step S200 and step S300, a Tor network ecological vulnerability graph VG is constructed using the network connectivity graph G, server descriptor information, asset security attribute information and relay node attribute vulnerability scores; S500. Based on step S400, the structural vulnerability of the relay nodes of the Tor network ecological vulnerability graph is measured using the weighted centrality measurement algorithm and the graph convolutional network algorithm, and the comprehensive vulnerability score of the relay nodes is calculated; Among them, the weighted centrality measurement algorithm includes weighted degree centrality, weighted betweenness centrality, weighted closeness centrality and weighted PageRank score.

2. According to a Tor relay node vulnerability assessment method based on an ecological vulnerability graph according to claim 1, it is characterized in that: The step S100 includes the following steps: S110. Determine the type of relay node to be deployed. The selectable relay node types include entry relay node, intermediate relay node and exit relay node; S120. Select the corresponding method to set up a new Tor relay node according to the server platform type supported by Tor; S130. Based on the Tor control protocol, connect to the Tor process through a socket and send a new link instruction to operate the Tor client, and receive the link connection information returned after the instruction is executed; S140. Repeat the above step S130, continuously obtain new link connection information, and generate a network connectivity graph G according to the method of <relay node IP, relay node IP, link connection>.

3. According to a Tor relay node vulnerability assessment method based on an ecological vulnerability graph according to claim 1, it is characterized in that: The relay node server descriptor in step S200 specifically includes the following contents: The descriptor type and version number of each relay node, type, nickname, IP address, port number, Ed25519 algorithm master key, Tor software version and operating platform. Tor protocol characteristics, release time, fingerprint, running time, bandwidth information, additional information summary, whether it acts as a hidden service directory, operator contact information, bridge node distribution request, NTor Onion key, rejection rule, whether it supports tunnel directory server and node summary; the attributes used for subsequent composition are operator contact information and family information.

4. According to claim 1, a Tor relay node vulnerability assessment method based on ecological vulnerability graph is characterized in that: The step S300 includes the following steps: S310. Using the public asset mapping platform and vulnerability scanning tools, obtain the asset security attribute information of the server corresponding to each relay node IP in the relay node IP list; S320. Score each security attribute according to a predefined weighted scoring rule; S330. Weight each security attribute information and use the formula Calculate the attribute vulnerability score S of each relay node Attr ; Among them, S Attr Score the vulnerability of the desired attribute, w i The weight corresponding to each security attribute, s i The score corresponding to each security attribute.

5. According to claim 4, a Tor relay node vulnerability assessment method based on ecological vulnerability graph is characterized in that: The step S310 includes the following steps: S311. Use the public asset mapping platform to query the IP in the relay node IP list to obtain the operating system name of the server corresponding to each relay node IP, whether it is an IoT device, open ports, firewall or CDN, regional information, component quantity and version number, web response status code and web response header information; S312. Use a vulnerability scanning tool to scan the IPs in the relay node IP list to obtain vulnerability information of the server corresponding to each relay node IP.

6. According to claim 1, a Tor relay node vulnerability assessment method based on ecological vulnerability graph is characterized in that: The step S400 includes the following steps: S410. Based on step S100 and step S200, on the basis of the network connection graph G, an edge relationship <relay node IP, relay node IP, same server descriptor> is added to the relay nodes with the same server descriptor to generate a graph G', wherein the same server descriptor includes two types: operator contact information and family information; S420. Based on step 410 and step 300, in graph G', an edge relationship <relay node IP, relay node IP, same asset security attribute information symbol> is added to the relay nodes with the same asset security attribute information to generate graph G'', wherein the same asset security attribute information is the location, state / province and country included in the geographical information; S430. Based on step 420, add different weights to different types of edge relationships in graph G”; S440. Based on step S100 and step S300, add the attribute vulnerability score as the relay node attribute for each relay node in graph G”, and finally construct the Tor network ecological vulnerability graph VG.

7. The Tor relay node vulnerability assessment method based on ecological vulnerability graph according to claim 6 is characterized in that: The step S430 includes the following steps: S431. Add a weight of 0.4 to <relay node IP, relay node IP, link connection> in Figure G”; S432. Add a weight of 0.3 to <relay node IP, relay node IP, same server descriptor> in Figure G”; S433. Add a weight of 0.3 to <relay node IP, relay node IP, same asset security attribute information> in Figure G”.

8. The Tor relay node vulnerability assessment method based on ecological vulnerability graph according to claim 1 is characterized in that: The step S500 includes the following steps: S510. Using a variety of weighted centrality measurement algorithms, perform centrality measurement on each relay node in the Tor network ecological vulnerability graph VG and obtain the centrality measurement score S Cent , the weighted centrality measurement algorithms include weighted degree centrality, weighted betweenness centrality, weighted closeness centrality and weighted PageRank score; S520. Use the graph convolutional network to normalize each relay node in the graph and use the L2 norm to calculate the vector Euclidean length S L2 ; S530. Using attribute vulnerability score S Attr , the centrality measure score S Cent , Euclidean length S L2 Perform weighted summation and use formula S V =0.5*S Attr +0.3*S Cent +0.2*S L2 Calculate the comprehensive vulnerability score S of each relay node V .

9. The Tor relay node vulnerability assessment method based on ecological vulnerability graph according to claim 8 is characterized in that: The step S510 includes the following steps: S511. For each relay node, use the formula Calculate weighted degree centrality Among them, N(v) is the set of nodes connected to node v, w uv is the weight of the edge from node u to node v; S512. For each relay node, use the formula Calculating betweenness centrality Among them, σ st is the number of shortest paths between nodes s and t, σ st (v) is the number of shortest paths between nodes s and t that pass through node v; S513. For each relay node, use the formula Calculating closeness centrality Among them, d w (u,v) is the weight of the shortest path from node u to v; S514. For each relay node, use the formula Calculate the weighted PageRank score PR w (v); Where N is the total number of nodes in the graph, d is the damping factor in the PageRank score, and w uv is the weight of the edge from node u to node v, and Neighbors(v) is the set of nodes connected to node v; S515. Normalize the multiple weighted centrality metrics of the relay nodes respectively, and calculate their average value as the relay node centrality metric score. The normalization formula is: Among them, x represents a certain type of weighted centrality measurement score of a pair of relay nodes, and X represents a certain type of weighted centrality measurement score set for all relay nodes.

10. The Tor relay node vulnerability assessment method based on ecological vulnerability graph according to claim 8, characterized in that: The step S520 includes the following steps: S521. Using the graph convolutional network, embed each relay node in the Tor network ecological vulnerability graph VG and obtain a normalized vector representation; S522. Using the L2 norm formula Calculate the Euclidean length of the vector ||x||2; Where x is a binary number containing n elements x1, x2, …, x n Vector.

Images