Flow beacon detection method based on heterogeneous network image coding

Abstract

The invention relates to the technical field of network security traffic tracking, in particular to a traffic beacon detection method based on heterogeneous network image coding, which comprises the following steps of: embedding a watermark by changing the time interval of a data packet, flattening a data code by adopting a coding mechanism, embedding a time sequence, and quickly positioning the watermark by a receiver through network transmission. And extraction and identification are carried out. The method mainly solves the problem of high-concealment and low-overhead traffic watermarking resisting network noise interference in a non-cooperative network environment, overcomes the defect that an existing flow watermarking scheme is only suitable for a single type of flow for traffic with large traffic time characteristic difference and different network applications, and achieves a better data flow tracking and tracing effect.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic tracking, and in particular to a traffic beacon detection method based on heterogeneous network image coding. Background Art

[0002] At present, some research has been carried out on network attack source tracing technology, but it still faces many challenges. Since Staniford-Chen and Heberlein first proposed the problem of springboard detection, researchers have proposed several springboard detection schemes using encrypted traffic, mainly divided into two technologies: passive detection and active tracking. Passive traffic analysis records certain traffic characteristics of inlet and outlet traffic, and then analyzes and compares the traffic characteristic data to determine whether there is a correlation between traffic. This scheme has problems such as large space overhead, poor real-time performance, and low recognition rate that need to be solved. The active network flow watermarking technology that integrates active network traffic analysis and digital watermarking carries watermarks by actively changing certain traffic characteristics of the suspicious sender. After network transmission, the watermark is extracted at the receiving end to determine the communication relationship between the sender and the receiver. The watermark and detection of the traffic will be performed according to the selected different traffic characteristics, but it faces problems such as low detection rate and high watermarking scheme overhead. Based on the fact that the current network attack methods are constantly changing and showing organized characteristics, and the network attacks are in the form of cross-border and multi-level springboards, it is more difficult to trace the source, obtain evidence and block the attack. Therefore, in the current network attack and defense confrontation situation, firstly, APT attack organizations use a large number of overseas springboard nodes and encryption protocols, and the existing defense means mostly rely on the reconnaissance and capture of domestic points and lines, and it becomes increasingly difficult to identify the source and destination of attack traffic; secondly, the APT organization is more complicated and diverse in obtaining the return and attack paths of attack point control information, file information, etc., and the attack and return methods are mainly cached and non-cached. How to quickly and accurately analyze the attack path situation and implement perception and early warning of attack path changes is a difficult problem in current network defense.

[0003] Under the condition of complex network interference, the network traffic carrying watermark information in the actual communication of non-buffered network structure may be interfered by factors such as delay and packet loss. The ability to correctly transmit watermark information in this environment is called the robustness of the stream watermark. Therefore, how to build a highly robust, low-cost, and highly concealed watermark and detection technology solution that is resistant to detection by attackers is the focus of current research on network traffic tracking and tracing. Summary of the invention

[0004] The purpose of the present invention is to provide a traffic beacon detection method based on heterogeneous network image coding, which embeds information into the time series in a coded manner to achieve information hiding, thereby improving the fault tolerance, real-time detection and amount of coded information of the watermarking scheme in active defense, and achieving better traffic tracking and tracing effects. The technical solution is as follows: A traffic beacon detection method based on heterogeneous network image coding comprises the following steps: Step 1: Encode the watermark according to the first layer of data encoding layer Based on the graph coding mechanism, the data coding layer of the watermark control center encodes the watermark data, outputs a one-dimensional matrix as the watermark after flattening, and then sends it to the network device; Step 2: Complete the stream watermark processing according to the watermark embedding layer of the second layer After receiving the watermark, the network device of the sender embeds the watermark by changing the interval time of the data packet to achieve information hiding, and transmits the watermark through the network; Step 3: Perform stream watermark detection based on the watermark recognition layer of the third layer After the receiver identifies the positioning point of the encoded watermark, it determines whether it has reached the watermark start node based on the characteristics of the positioning point, and extracts and decodes the watermark to realize the detection of the traffic beacon.

[0005] Furthermore, the step 1 is specifically as follows: In the original case without watermark embedding, the sender maintains the time interval sequence ; For the time interval, , is the number of time intervals; Extract the sender's time interval sequence As the original data to be embedded with watermark; Based on the graph coding mechanism, the original data is encoded to obtain a Preamble and a The two-dimensional matrix ; Finally, the preamble With the flattened two-dimensional matrix Splice to get A one-dimensional matrix with two possible values ​​of , and output it as a watermark.

[0006] Furthermore, the step 2 is specifically as follows: Starting from the watermark embedding position, according to the one-dimensional matrix The value of the element in the original time interval sequence After watermark embedding, the time interval sequence of the sender is ; ; in, and are the time interval sequences of the sender after embedding the watermark and a one-dimensional matrix Middle The value of the element; The time interval The average value is taken as the original value, the increment is a multiple of the original value; After being transmitted over the network, the receiver receives the time interval sequence disturbed by network noise. , thereby realizing watermark transmission.

[0007] Furthermore, the step 3 is specifically as follows: Take a sliding window , whose size is , the step length is ; If the time interval sequence is disturbed by network noise Sliding window in If the following conditions are met, it is judged as the watermark start node, and the watermark is extracted from this node , the watermark Expand to a two-dimensional matrix Then, the two-dimensional matrix is ​​extracted using the two-dimensional code extraction algorithm. Extract information to get hidden information, otherwise slide backward step size step until no more data is received; ; in, and Sliding windows The size of the two sub-windows in is the difference between the starting position indexes of the two subwindows. is the similarity threshold, and The time interval series The elements in and They are one-dimensional matrices The elements in .

[0008] Furthermore, it also includes the use of stream watermarks and attack path reconstruction, specifically: Abstract the network as a graph ,in is a collection of nodes, is a set of edges; each node Represents a router or switch in the network. Each edge Represents the connections between nodes; Traffic from the node To Node The path is represented as , if at node If a watermark is detected, then the node To Node During the communication process, the nodes Is an intermediate node, there is a path , and iterate repeatedly.

[0009] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention is based on a flow beacon detection method for heterogeneous network image coding, and watermarks are embedded by changing the time interval of data packets. A coding mechanism is used to flatten the data code and embed it into a time series. After network transmission, the receiver quickly locates the watermark, extracts it, and identifies it. The present invention mainly solves the problem of high-concealment and low-overhead flow watermarks that are resistant to network noise interference in a non-cooperative network environment. It aims at flows with large differences in flow time characteristics and different network applications, and makes up for the deficiency that the existing flow watermarking scheme is only applicable to a single type of flow, thereby achieving better flow tracking and tracing effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is an overall architecture diagram of the traffic beacon detection method based on heterogeneous network image coding of the present invention.

[0011] Figure 2 Schematic diagram of the encoding mechanism.

[0012] Figure 3 This is a diagram of packet spacing modulation based on image coding.

[0013] Figure 4 This is a schematic diagram of the positioning points.

[0014] Figure 5 Reconstruct the graph for the path.

[0015] Figure 6 This is the experimental result diagram of the number of encoding modules.

[0016] Figure 7 This is the result diagram of the fault tolerance experiment.

[0017] Figure 8 This is the IPD increment experiment result diagram.

[0018] Fig. 9 This is the experimental result diagram of watermark embedding position.

[0019] Fig.10This is the experimental result of positioning window size.

[0020] Fig.11 The fuzziness experiment results are shown in the coloring condition of encoding one bit of IPD for one packet time interval, i.e., 1 IPD / bit.

[0021] Fig.12 The ambiguity experiment results are shown in the coloring condition of encoding one bit of IPD for the time interval between 2 packets, i.e., 2 IPD / bit.

[0022] Fig.13 The ambiguity experiment results are shown in the coloring condition of encoding one bit of IPD for 4 packet time intervals, i.e. 4 IPD / bit.

[0023] Fig.14 This is the result of the IPD mutation experiment under the encoding condition of Code 128.

[0024] Fig.15 This is the result of the IPD mutation experiment under Data Matrix encoding conditions.

[0025] Fig.16 This is the result of the IPD mutation experiment under the encoding conditions of PDF417.

[0026] Fig.17 This is the result of the IPD mutation experiment under the QR Code encoding condition. DETAILED DESCRIPTION

[0027] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0028] This invention aims to improve the ability to monitor and track network attack threats, and to address the lack of attack identification, feature detection, and evidence collection of attack behaviors. It makes comprehensive use of the active defense-based watermarking technology in an incomplete environment to conduct research on attack traffic tracing technology. By studying the communication entity watermarking and attack path restoration technology, the collision detection mechanism of watermarked traffic under incomplete network conditions is studied. Under incomplete attack path conditions, the watermarked traffic is used to render the detection mechanism of the attack chain to restore the attack roadmap, providing a means for analyzing the attack path and attack intent.

[0029] The present invention provides a flow beacon detection method based on heterogeneous network image coding, referred to as CodeFlow. In view of the problems of low fault tolerance, low detection real-time performance and little coding information in active defense watermarking schemes, an information hiding scheme using time series as the network flow watermark coding carrier is proposed. In the original case where no watermark is embedded, the sender embeds the watermark by changing the time interval of the data packet, and adopts a variety of coding schemes to encode the identifiable features and embed them into the time series to achieve information hiding; after partial packet interval modulation within the modulation window, it is transmitted through the network, and the receiver performs rapid positioning and identification, and then extracts the watermark information with higher fault tolerance and uses a smaller buffer to temporarily store several data packets of the traffic, thereby improving the tracking effectiveness based on the stream watermark method.

[0030] In order to enhance the capacity of embedding watermark information in traffic in active defense, the intra-flow packet controllable information is selected as the watermark carrier. The intra-flow packet controllable information refers to the information carried inside each data packet in the network traffic for controlling and monitoring network behavior. This information carries rich control information and can be controlled to achieve the purpose of more detailed monitoring and management of traffic. For example, the packet time interval (IPD) is embedded in the watermark information bit by slightly adjusting the size of multiple IPDs or the average value of IPDs. , achieving the purpose of carrying watermarks in traffic. This method embeds watermark information bits by adjusting specific IPDs, making the operation on traffic more fine-grained and applicable to long and short traffic. At the same time, more watermark information bits can be embedded in the traffic, which can significantly increase the capacity of traffic to carry watermark information. Compared with traditional methods, the proposed method uses a smaller buffer to temporarily store several data packets of the traffic, which improves the tracking effectiveness based on the stream watermark method.

[0031] The present invention verifies the effect of the scheme through the recognition rate, and the recognition rate refers to the ratio of the number of experimental samples that the receiver correctly locates the watermark position and recognizes the watermark content.

[0032] The technology is divided into three layers: The first layer: data coding layer: Based on the graph coding mechanism, the data coding layer of the watermark control center encodes the watermark data, outputs one-dimensional data as the watermark after flattening, and then sends it to the network device; The second layer: watermark embedding layer: responsible for stream watermark processing. After receiving the watermark, the network device of the sender embeds the watermark by changing the interval time of the data packet to achieve information hiding, and transmits the watermark through the network transmission; The third layer: watermark recognition layer: responsible for detecting stream watermarks. After the receiver identifies the positioning point of the encoded watermark, it marks the traffic as watermarked traffic, thereby triggering the watermark extraction and decoding process.

[0033] The overall structure of the present invention is as follows Figure 1 shown.

[0034] The data encoding layer is specifically implemented as follows: In the original case without embedding watermark, the sender maintains the time interval sequence . First, the first layer of data encoding is performed, which is responsible for encoding the watermark data. Watermark data is a flow identifier that can carry information and is generated by the watermark control center and sent to network devices. In order to prevent forgery, the watermark control center needs to regularly change the watermark information and notify the device to activate and update at a specified absolute time point. The present invention provides a variety of encoding mechanisms such as Figure 2 As shown in Figure 2, the information capacity and error tolerance of each scheme are different. According to the graph coding mechanism, the watermark data is encoded into a two-dimensional matrix Due to the interference of network noise, it is necessary to introduce Preamble , used to provide buffering for subsequent data signals. Therefore, the total interference to the traffic is Finally, the preamble With the flattened two-dimensional matrix Splice to get the transformed one-dimensional matrix .

[0035] The specific implementation of the watermark embedding layer is as follows: One-dimensional matrix is the output of the data encoding layer, a one-dimensional matrix The elements in The watermark embedding layer needs to be based on a one-dimensional matrix The value of the element in is used to modify the packet time interval accordingly. Starting from the watermark embedding position, the time interval sequence of the sender after the watermark is embedded is , .

[0036] After being transmitted over the network, the receiver receives the time interval sequence disturbed by network noise. , so as to realize watermark transmission, based on the image coding packet interval modulation diagram Figure 3 shown.

[0037] The specific implementation of the watermark recognition layer is as follows: Since all encoding schemes contain positioning points, the encoding position can be determined by the positioning points. Therefore, it is possible to determine whether the watermark starting position has been reached based on the positioning points. Figure 4 As shown, the side length of the small black square in the center of the positioning point is 3 units, the side length of the white ring in the middle is 5 units, and the side length of the outermost side of the positioning point is 7 units. Take a sliding window , whose size is , the step length is ; If the time interval sequence is disturbed by network noise Sliding window in If the following conditions are met, it is judged as the watermark start node, and the watermark is extracted from this node , the watermark Expand to a two-dimensional matrix Then, use the QR code extraction algorithm to Extract information and get hidden information, otherwise slide back Steps until no more data is received: ; in, and Sliding windows The size of the two sub-windows in is the difference between the starting position indexes of the two subwindows. is the similarity threshold, and The time interval series The elements in and They are one-dimensional matrices The elements in .

[0038] In order to prevent forgery, the watermark control center needs to Change the watermark information every hour and The watermark information to be replaced is sent every hour, notifying the watermark device to activate and update at the specified absolute time point. In addition, each watermark information has an expiration time. In order to further prevent watermark forgery and ensure the timeliness of data packets, the network stream watermark technology also introduces a serial number tag. The serial number not only provides a unique identifier for each data packet, but also tracks the order and timestamp of the data packet through incremental changes, effectively preventing replay attacks and tampering of the data packet.

[0039] The present invention also includes the use of stream watermarks and attack path reconstruction, specifically: In network data transmission, by extracting and analyzing traffic features, the collected communication traffic can be compared for similarity, thereby identifying communication traffic related to attack traffic detected at the network boundary. Communication traffic refers to the data traffic transmitted in a computer network, including data exchanged between various devices in the network. Communication traffic can include various forms of data, such as web browsing, file transfer, video traffic, etc. By analyzing these communication flows, key information such as source IP address and destination IP address can be extracted, and based on the transmission time of traffic between different devices, network attack paths such as Figure 5 As shown, Figure 5 A-L are network nodes.

[0040] If information is transmitted from a source node to a destination node, the intermediate nodes can detect the watermark information, which indicates that there is a transmission path including these nodes. The network can be abstracted as a graph ,in is a collection of nodes, is a set of edges. Each node Represents a router or switch in the network. Each edge Represents the connection between nodes. Traffic from the node To Node The path can be expressed as , and the watermark detection on the path can be expressed as a function ,in Indicates that a watermark is detected on the node. Indicates that no watermark is detected. If at node A watermark is detected. , we can determine the node To Node During the communication process, the nodes Is an intermediate node, there is a path .

[0041] Finally, the performance of the algorithm is tested to explore the impact of different parameter combinations on the recognition rate. The size of is determined by the code. Due to the limitation of the QR code coding mechanism and the watermark length, the available QR code sizes are limited. For QR codes with different numbers of coding modules, the present invention measures their recognition rates. Figure 6 As shown. The QR code encoding mechanism provides four error tolerance options, namely L-low error tolerance (7%), M-medium error tolerance (15%), Q-high error tolerance (25%) and H-high error tolerance (30%). For two-dimensional matrices with different error tolerances , the present invention measured their recognition rates, and the specific results are as follows Figure 7 As shown in the figure, a better result is achieved when the fault tolerance rate is 25%.

[0042] When embedding watermarks, different network conditions have different increments. The present invention takes the average value of the sender's IPD when no watermark is superimposed as the original value, and the increment is is a multiple of the original value. For different increments, their recognition rates are measured. The specific results are as follows Figure 8 As shown, the recognition rate is already very high when the multiple is 2.5.

[0043] The watermark embedding position is also one of the factors that determine the effectiveness of the scheme. At the beginning of network transmission, due to the overhead of establishing a connection, the network condition is poor. Therefore, the present invention inserts watermarks at different nodes and measures their recognition rates. The specific results are as follows: Fig. 9 As shown in Figure 2, starting from the 700th node, the recognition rate tends to be stable and maintained at a high level. This result shows that the watermark embedding position cannot be at the beginning of network transmission.

[0044] When identifying the watermark, the receiver retains a positioning window. The function of the positioning window is to locate the watermark, that is, to determine whether the starting node of the watermark has been reached. Since the QR code itself has positioning points of uniform size, the present invention uses the positioning points to locate the watermark, and the positioning window size is set to the range of positioning points covered. For example, when the window size is 0.5, it covers the first row of the upper left corner positioning points; when the window size is 1, it covers the first row of the upper left corner positioning points and the first row of the positioning window in the upper right corner, and so on. For different positioning window sizes, the present invention measured their recognition rates, and the results are as follows: Fig.10 As shown in the figure, a positioning window size of 2.5 already has good results.

[0045] For the positioning window, the fuzziness is used to measure whether the watermark start node is reached. Fig.11 The influence of ambiguity on positioning accuracy under the coloring condition of 1 IPD / bit is discussed; Fig.12 This corresponds to the case of 2 IPD / bit. Fig.13 The results of 4 IPD / bit are shown. The horizontal axis in the figure represents the ambiguity of positioning, which decreases from 1 to 0.7 with a step size of 0.02. The vertical axis corresponds to four positioning methods, namely QR Code positioning, PDF417 positioning, Data Matrix positioning and Code 128 positioning. As can be seen from the figure, QR Coded positioning and Code128 positioning are the two best positioning methods. Under the condition of 1 IPD / bit, their accuracy can reach about 96% and 91% respectively. In the other two watermarking methods, the accuracy can reach about 100%, and the best positioning ambiguity is at least about 0.74 and about 0.84 respectively. Overall, for the watermarking method, using 2 IPD / bit has the best effect. The accuracy of 1 IPD / bit is low, and although 4 IPD / bit shows a high positioning accuracy under high ambiguity, its accuracy drops sharply as the ambiguity decreases, and finally about 0%. In addition, 4 IPD / bit has a large interference with traffic, which reduces the concealment of the watermark.

[0046] Table 1 discusses the effects of watermarking, positioning, and encoding on recognition accuracy. The results show that regardless of the watermarking method, the highest recognition rate can be obtained using QR Code encoding, while Code128 encoding has the lowest accuracy, only about 20%. In terms of watermarking, as the IPD encoding density increases, the recognition rate improves overall, especially in the case of 4 IPD / bit, the recognition rates of the three positioning methods are close to or exceed 94%. For positioning methods, QR positioning performs slightly weaker at low density, with a recognition rate of about 91% at 2 IPD / bit, but performs well at high density. Code128 positioning performs best at 2IPD / bit, exceeding other positioning methods by about 4%, but is not as stable as Origin positioning at low and high densities. Origin positioning performs well at all densities and is suitable for applications that require stable and high recognition rates.

[0047] Table 1 The impact of positioning method and encoding method on recognition accuracy .

[0048] The basic unit of the packet interval-based watermark is the time difference between two data packets, and this time difference may be wrong. Fig.14 The change ratio of IPD mutation under Code 128 encoding was analyzed; Fig.15 Using DataMatrix encoding, Fig.16 The corresponding code is PDF417. Fig.17 = is the encoding of the QR Code. Different images indicate different watermark encoding methods. The ordinate is the change ratio. Long to short represents the frequency of long IPD changing to short IPD, and short to long represents the frequency of short IPD changing to long IPD. The experimental results show that under different encoding methods, the probability of long IPD changing to short IPD is relatively high, with an average of less than 0.2, and the probability of short IPD changing to long IPD is extremely small, with an average of less than 0.01, which can be ignored.

Claims

1. A traffic beacon detection method based on heterogeneous network image coding, characterized in that: The following steps are involved: Step 1: Encode the watermark according to the first layer of data encoding layer Based on the graph coding mechanism, the data coding layer of the watermark control center encodes the watermark data, outputs a one-dimensional matrix as the watermark after flattening, and then sends it to the network device; Step 2: Complete the stream watermark processing according to the watermark embedding layer of the second layer After receiving the watermark, the network device of the sender embeds the watermark by changing the interval time of the data packet to achieve information hiding, and transmits the watermark through the network; Step 3: Perform stream watermark detection based on the watermark recognition layer of the third layer After the receiver identifies the positioning point of the encoded watermark, it determines whether it has reached the watermark start node based on the characteristics of the positioning point, and extracts and decodes the watermark to realize the detection of the traffic beacon.

2. According to claim 1, a traffic beacon detection method based on heterogeneous network image coding is characterized in that: The step 1 is specifically as follows: In the original case without watermark embedding, the sender maintains the time interval sequence ; For the time interval, , is the number of time intervals; Extract the sender's time interval sequence As the original data to be embedded with watermark; Based on the graph coding mechanism, the original data is encoded to obtain a Preamble and a The two-dimensional matrix ; Finally, the preamble With the flattened two-dimensional matrix Splice to get A one-dimensional matrix with two possible values: , and output it as a watermark.

3. According to claim 2, a traffic beacon detection method based on heterogeneous network image coding is characterized in that: The step 2 is specifically as follows: Starting from the watermark embedding position, according to the one-dimensional matrix The value of the element in the original time interval sequence After watermark embedding, the time interval sequence of the sender is ; ； in, and are the time interval sequences of the sender after embedding the watermark and a one-dimensional matrix Middle The value of the element; The time interval The average value is taken as the original value, the increment is a multiple of the original value; After being transmitted over the network, the receiver receives the time interval sequence disturbed by network noise. , thereby realizing watermark transmission.

4. According to claim 3, a traffic beacon detection method based on heterogeneous network image coding is characterized in that: The step 3 is specifically as follows: Take a sliding window , whose size is , the step length is ; If the time interval sequence is disturbed by network noise Sliding window in If the following conditions are met, it is judged as the watermark start node, and the watermark is extracted from this node , the watermark Expand to a two-dimensional matrix Then, the two-dimensional matrix is ​​extracted using the two-dimensional code extraction algorithm. Extract information to get hidden information, otherwise slide backward step size step until no more data is received; ； in, and Sliding windows The size of the two sub-windows in is the difference between the starting position indexes of the two subwindows. is the similarity threshold, and The time interval series The elements in and They are one-dimensional matrices The elements in .

5. The method for detecting traffic beacons based on heterogeneous network image coding according to claim 1 is characterized in that: It also includes the use of stream watermarks and attack path reconstruction, specifically: Abstract the network as a graph ,in is a collection of nodes, is a set of edges; each node Represents a router or switch in the network. Each edge Represents the connections between nodes; Traffic from the node To Node The path is represented as , if at node If a watermark is detected, it is determined that at the node To Node During the communication process, the nodes Is an intermediate node, there is a path , and iterate repeatedly.

Images