Network time covert channel construction method and device based on perceptual hash

Abstract

The invention relates to the technical field of network information security, in particular to a network time covert channel construction method and device based on perceptual hashing, and the method comprises the following steps: obtaining an inter-packet time delay sequence of legal traffic of a public data set, and filtering and coding the inter-packet time delay sequence according to a set filtering rule and a set coding rule, obtaining a first IPD sequence and a first coding sequence; generating a spreading code with the length of N according to the key, and performing spectrum spreading on the plaintext according to the spreading code to obtain the plaintext after spectrum spreading; retrieving in the first coding sequence according to the plaintext after spectrum spreading to obtain a second coding sequence, and generating a perceptual hash sequence according to the second coding sequence and the first IPD sequence; and restoring the perceptual hash sequence according to the coding rule and the spreading code to obtain a plaintext. According to the method, the legal flow value and the regularity are simulated, and the spreading code is generated by using the secret key, so that the problem that a traditional network time covert channel is insufficient in concealment and safety is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a method and device for constructing a network time covert channel based on perceptual hashing. Background Art

[0002] In modern network communications, network covert channel technology has become an important means of data transmission, especially in situations where communication privacy and security need to be guaranteed. Network covert channels use the characteristics of the normal communication process of the network that are not used in a standardized way to transmit information, thereby concealing data transmission activities. Although covert channels have significant advantages in private communication and confidential information transmission, traditional covert channel methods often face the problem of insufficient performance in various aspects. Traditional network time covert channels are easily detected by modern network monitoring tools. These channels usually encode information by adjusting the transmission time of data packets, but they often produce repetitive patterns that can be identified by analyzing the statistical characteristics of network traffic. And because they often pursue high transmission rates, they do not have the ability to transmit in non-ideal environments. Fluctuations in network conditions, such as delays and noise, can seriously affect the performance of traditional covert channels. The sensitivity of these channels to network delays makes them difficult to remain stable and reliable in dynamic or unstable network environments.

[0003] In view of the shortcomings of the existing technology, there is an urgent need to develop a method and device for constructing a network time covert channel based on perceptual hashing to improve the concealment and security of transmission, and to enhance the robustness of the channel, overcome the above challenges, and provide new solutions for network communication security. Summary of the invention

[0004] The purpose of this application is to propose a method and device for constructing a network time covert channel based on perceptual hashing in response to the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides a method for constructing a network time covert channel based on perceptual hashing, comprising the following steps:

[0006] Obtaining an inter-packet delay sequence of legitimate traffic of a public data set, and filtering and encoding the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence;

[0007] Generate a spreading code with a length of N according to the key, and spread the plaintext according to the spreading code to obtain the spread plaintext;

[0008] Retrieving the first coding sequence according to the spread plaintext to obtain a second coding sequence, and generating a perceptual hash sequence according to the second coding sequence and the first IPD sequence;

[0009] The perceptual hash sequence is restored according to the encoding rules and the spreading code to obtain the plaintext.

[0010] Preferably, obtaining the inter-packet delay sequence of the legitimate traffic of the public data set, and filtering and encoding the inter-packet delay sequence according to the set filtering rule and encoding rule to obtain the first IPD sequence and the first encoding sequence specifically includes:

[0011] Sort all the inter-packet delays in the inter-packet delay sequence from small to large to obtain a second IPD sequence;

[0012] The filtering rule is as follows: the second IPD sequence is divided into a front coding area, a filtering area and a rear coding area, the inter-packet delay in the filtering area is filtered out, the first partition cutoff point of the front coding area and the filtering area is reserved, the second partition cutoff point of the filtering area and the rear coding area is reserved, and the order between the inter-packet delays in the inter-packet delay sequence is reserved, and the inter-packet delay of the front coding area, the first partition cutoff point, the second partition cutoff point and the inter-packet delay of the rear coding area constitute a third IPD sequence;

[0013] The encoding rule is as follows: the inter-packet delay of the front coding area and the first partition cutoff point are encoded as 1, and the second partition cutoff point and the inter-packet delay of the rear coding area are encoded as -1, and a third encoding sequence is obtained;

[0014] The third IPD sequence and the third coding sequence are rearranged according to the order of the inter-packet delays in the inter-packet delay sequence to obtain the first IPD sequence and the first coding sequence, and the inter-packet delay of the first IPD sequence and the coding of the first coding sequence correspond one to one.

[0015] Preferably, searching in the first coding sequence according to the plaintext after spread spectrum to obtain the second coding sequence specifically includes:

[0016] The spread plaintext includes a plurality of spread sequences, each of which has a length of N, and each spread sequence corresponds to a plaintext bit of each spread plaintext, and each spread sequence is searched in the first coding sequence;

[0017] When a code identical to the current spreading sequence is retrieved, the current spreading sequence retrieval is completed, and the current retrieval position is retained, and a sequence composed of all the retrieved codes is used as a fourth code sequence;

[0018] Starting from the current search position, searching for the next spread spectrum sequence in the first coding sequence;

[0019] When the last bit of the first coding sequence is retrieved but the current spread spectrum sequence has not been retrieved, jump to the first bit of the first coding sequence and retrieve the current spread spectrum sequence again;

[0020] A second coding sequence is generated according to fourth coding sequences corresponding to all spreading sequences.

[0021] Preferably, a perceptual hash sequence is generated according to the second coding sequence and the first IPD sequence and sent, specifically including: retrieving the corresponding inter-packet delay in the first IPD sequence according to the second coding sequence, and using the sequence constituted by the retrieved inter-packet delay as the perceptual hash sequence corresponding to the plaintext after spread spectrum.

[0022] Preferably, the perceptual hash sequence is restored according to the encoding rule and the spread spectrum code to obtain the plain text, which specifically includes:

[0023] Compare the inter-packet delays of all perceptual hash sequences with the first partition cutoff point and the second partition cutoff point. If the inter-packet delay of the perceptual hash sequence is less than or equal to the first partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is 1. If the inter-packet delay of the perceptual hash sequence is greater than or equal to the second partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is -1, and a fifth coding sequence is obtained.

[0024] The fifth coding sequence is divided into a plurality of sixth coding sequences with a length of N according to the length N of the spread spectrum code, and all the sixth coding sequences are multiplied by the spread spectrum code to obtain plain text.

[0025] Preferably, the spread spectrum code is generated by using a nonlinear feedback shift register.

[0026] In a second aspect, the present invention provides a network time covert channel construction device based on perceptual hashing, comprising:

[0027] The encoding module is configured to obtain an inter-packet delay sequence of legitimate traffic of the public data set, and filter and encode the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence;

[0028] The spreading module is configured to generate a spreading code with a length of N according to the key, and spread the plaintext according to the spreading code to obtain the spread plaintext;

[0029] A perceptual hash sequence generation module is configured to search the first coding sequence according to the spread plaintext to obtain a second coding sequence, and generate a perceptual hash sequence according to the second coding sequence and the first IPD sequence;

[0030] The perceptual hash sequence extraction module is configured to restore the perceptual hash sequence according to the encoding rule and the spread spectrum code to obtain the plain text.

[0031] In a third aspect, the present invention provides an electronic device comprising one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0032] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0033] In a fifth aspect, the present invention provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] (1) The network time covert channel construction method based on perceptual hashing proposed in the present invention combines the idea of ​​perceptual hashing, spread spectrum code, key encryption and discrete partition coding, which greatly improves the robustness of the channel; further, the order and value of the inter-packet delay sequence of the legitimate traffic are not changed, the legitimate traffic is replayed to simulate the legitimate traffic value and regular distribution, and the perceptual hash sequence is encrypted and extracted according to the spread spectrum code generated by the set key, which ensures the security of the channel and comprehensively improves the performance of the traditional covert channel construction technology.

[0036] (2) The network time covert channel construction method based on perceptual hashing proposed in the present invention filters and encodes the inter-packet delay sequence of the acquired legitimate traffic, so that slight jitter in the perceptual hashing sequence can be allowed during the information transmission process, thereby ensuring the encoding distinctiveness.

[0037] (3) The method for constructing a network time covert channel based on perceptual hashing proposed by the present invention uses a spread spectrum code so that when the number of flips of the perceptual hash sequence is less than , the perceived hash sequence can be correctly restored to obtain the plaintext. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flowchart of a method for constructing a network time covert channel based on perceptual hashing according to an embodiment of the present application;

[0040] Figure 2 The change of transmission rate of the network time covert channel based on perceptual hashing under different selection of spreading code lengths in the embodiment of the present application;

[0041] Figure 3 The change of the bit error rate of the network time covert channel based on perceptual hashing under different selection of the length of the spreading code in the embodiment of the present application;

[0042] Figure 4 AUC comparison diagram of the network time covert channel and dynamic coding channel based on perceptual hashing in an embodiment of the present application when detected using a covert channel detection method (GAS) based on a long short-term memory network;

[0043] Figure 5 A schematic diagram of a network time covert channel construction device based on perceptual hashing according to an embodiment of the present application;

[0044] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Figure 1 A method for constructing a network time covert channel based on perceptual hashing provided by an embodiment of the present application is shown, comprising the following steps:

[0047] S1, obtaining an inter-packet delay sequence of legitimate traffic of a public data set, and filtering and encoding the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence.

[0048] In a specific embodiment, obtaining an inter-packet delay sequence of legitimate traffic of a public data set, filtering and encoding the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence specifically includes:

[0049] Sort all the inter-packet delays in the inter-packet delay sequence from small to large to obtain a second IPD sequence;

[0050] The filtering rule is as follows: the second IPD sequence is divided into a front coding area, a filtering area and a rear coding area, the inter-packet delay in the filtering area is filtered out, the first partition cutoff point of the front coding area and the filtering area is reserved, the second partition cutoff point of the filtering area and the rear coding area is reserved, and the order between the inter-packet delays in the inter-packet delay sequence is reserved, and the inter-packet delay of the front coding area, the first partition cutoff point, the second partition cutoff point and the inter-packet delay of the rear coding area constitute a third IPD sequence;

[0051] The encoding rule is as follows: the inter-packet delay of the front coding area and the first partition cutoff point are encoded as 1, and the second partition cutoff point and the inter-packet delay of the rear coding area are encoded as -1, and a third encoding sequence is obtained;

[0052] The third IPD sequence and the third coding sequence are rearranged according to the order of the inter-packet delays in the inter-packet delay sequence to obtain the first IPD sequence and the first coding sequence, and the inter-packet delay of the first IPD sequence and the coding of the first coding sequence correspond one to one.

[0053] Specifically, by filtering the inter-packet delay sequence of the obtained legitimate traffic in the filtering area according to the filtering rules, a slight jitter in the perceived hash sequence can be allowed during the information transmission process to ensure the coding distinctiveness and improve the robustness of the channel.

[0054] S2, generate a spreading code with a length of N according to the key, and spread the plaintext according to the spreading code to obtain the spread plaintext.

[0055] In a specific embodiment, the spread spectrum code is generated by using a nonlinear feedback shift register.

[0056] Specifically, the spread spectrum code is generated by a nonlinear feedback shift register (NLFSR), and the length N of the spread spectrum code can be defined according to different robustness requirements. The plaintext is spread according to the spread spectrum code to ensure the security of the channel.

[0057] S3, searching the first coding sequence according to the plain text after spread spectrum to obtain a second coding sequence, and generating a perceptual hash sequence according to the second coding sequence and the first IPD sequence.

[0058] In a specific embodiment, searching in the first coding sequence according to the plaintext after spread spectrum to obtain the second coding sequence specifically includes:

[0059] The spread plaintext includes a plurality of spread sequences, each of which has a length of N, and each spread sequence corresponds to a plaintext bit of each spread plaintext, and each spread sequence is searched in the first coding sequence;

[0060] When a code identical to the current spreading sequence is retrieved, the current spreading sequence retrieval is completed, and the current retrieval position is retained, and a sequence composed of all the retrieved codes is used as a fourth code sequence;

[0061] Starting from the current search position, searching for the next spread spectrum sequence in the first coding sequence;

[0062] When the last bit of the first coding sequence is retrieved but the current spread spectrum sequence has not been retrieved, jump to the first bit of the first coding sequence and retrieve the current spread spectrum sequence again;

[0063] A second coding sequence is generated according to fourth coding sequences corresponding to all spreading sequences.

[0064] In a specific embodiment, a perceptual hash sequence is generated according to a second coding sequence and a first IPD sequence and sent, specifically including: retrieving the corresponding inter-packet delay in the first IPD sequence according to the second coding sequence, and using the sequence constituted by the retrieved inter-packet delay as the perceptual hash sequence corresponding to the plaintext after spread spectrum.

[0065] Specifically, assuming that the obtained inter-packet delay sequences of legitimate traffic are sufficient to complete all possible changes in the inter-packet delay sequences in the real network environment, the present application can simulate the high entropy value chaos level of legitimate traffic.

[0066] S4, restore the perceptual hash sequence according to the encoding rules and the spread spectrum code to obtain the plaintext.

[0067] In a specific embodiment, the perceptual hash sequence is restored according to the encoding rule and the spread spectrum code to obtain the plain text, which specifically includes:

[0068] Compare the inter-packet delays of all perceptual hash sequences with the first partition cutoff point and the second partition cutoff point. If the inter-packet delay of the perceptual hash sequence is less than or equal to the first partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is 1. If the inter-packet delay of the perceptual hash sequence is greater than or equal to the second partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is -1, and a fifth coding sequence is obtained.

[0069] The fifth coding sequence is divided into a plurality of sixth coding sequences with a length of N according to the length N of the spread spectrum code, and all the sixth coding sequences are multiplied by the spread spectrum code to obtain plain text.

[0070] Specifically, the perceptual hash sequence refers to extracting data compression into a unique sequence with high robustness and discrimination for representation. Step S4 is a typical perceptual hash sequence extraction process, which shows high robustness in non-ideal network environments. The use of spread spectrum codes can make the perceptual hash sequence have a flip number less than , the perceived hash sequence can be correctly restored to obtain the plaintext.

[0071] In the examples of this application, reference is made to Figure 2 , the transmission rate of the network time covert channel based on perceptual hashing gradually decreases with the increase of the length N of the spreading code; reference Figure 3 , the decoding error rate of the network time covert channel based on perceptual hashing gradually decreases with the increase of the length N of the spread spectrum code. The network time covert channel design implemented in this application based on perceptual hashing and spread spectrum technology has high robustness, can increase the channel transmission quality in non-ideal network environments, can adapt to changes in network conditions, and ensure that the stability and reliability of communication can be maintained when network delays or interference occur.

[0072] Specifically, in an embodiment of the present application, the network time covert channel construction method based on perceptual hashing is used to construct a network time covert channel, which specifically includes the following steps:

[0073] T1, the inter-packet delay sequence of the legitimate traffic in the public data set obtained is {Δt1, Δt2, Δt3, Δt4, Δt5, Δt6, Δt7, Δt8, Δt9, Δt 10 ,Δt 11 ,Δt 12 ,Δt 13 ,Δt 14 ,Δt 15 ,Δt 16 ,Δt 17 ,Δt 18 ,Δt 19}, the inter-packet delay sequence is filtered and encoded according to the set filtering rules and encoding rules, and the obtained first IPD sequence and first encoding sequence are {Δt1, Δt3, Δt5, Δt6, Δt7, Δt 10 ,Δt 11 ,Δt 12 ,Δt 14 ,Δt 15 ,Δt 16 ,Δt 17 ,Δt 18 ,Δt 19} and {-1,-1,1,1,-1,1,-1,-1,-1,-1,1,-1,1}, the cutoff points of the first partition and the second partition are Δt and Δt6 respectively;

[0074] T2, generate a spreading code {-1,1,1} with a length of 3 according to the key, and spread the plaintext {1,-1,-1,1} according to the spreading code to obtain the spread plaintext {-1,1,1,1,-1,-1,-1,-1,-1,1,1};

[0075] T3, the plain text after spread spectrum includes four spread spectrum sequences {-1,1,1}, {1,-1,-1}, {1,-1,-1} and {-1,1,1}. According to the four spread spectrum sequences, a matching search is performed starting from the first bit of the first coding sequence, and the codes identical to the above four spread spectrum sequences are searched to obtain four fourth coding sequences. The second coding sequence is generated according to the fourth coding sequences corresponding to all spread spectrum sequences. The second coding sequence is the same as the plain text after spread spectrum. According to the second coding sequence, the corresponding inter-packet delays Δt3, Δt5, Δt6, Δt7 are retrieved in the first IPD sequence. 12 , Δt 14 , Δt 15 , Δt 12 , Δt 14 , Δt 15 , Δt 15 , Δt 16 and Δt 17 , the sequence of inter-packet delays retrieved is used as the perceptual hash sequence {Δt3, Δt5, Δt6, Δt 12 ,Δt 14 ,Δt 15 ,Δt 12 ,Δt 14 ,Δt 15 ,Δt 15 ,Δt 16 ,Δt 17};

[0076] T4, compare the inter-packet delay in the perceived hash sequence with the first partition cutoff point and the second partition cutoff point, and convert the perceived hash sequence into the fifth coding sequence {-1,1,1,1,-1,-1,-1,-1,-1,-1,1} according to the coding rule, and then divide the fifth coding sequence into four sixth coding sequences of length 3 according to the length 3 of the spread spectrum code, and use the spread spectrum code to despread all the sixth coding sequences to obtain 1, -1, -1, 1, that is, the plaintext is {1,-1,-1,1}.

[0077] The network time covert channel construction method based on perceptual hashing proposed in this application combines the idea of ​​perceptual hashing, spread spectrum code, key encryption and discrete partition coding to construct a new type of network time covert channel, improve the concealment and security of transmission and enhance the robustness of the channel. Specifically, by filtering and encoding the inter-packet delay sequence of the obtained legal traffic, and not changing the order and value of the inter-packet delay sequence of the legal traffic, the legal traffic is replayed to simulate the legal traffic value and regular distribution, reduce the detectability of the channel, and make it more concealed to the existing monitoring and analysis tools; and according to the spread spectrum code generated by the set key, the plaintext is spread and the generated perceptual hash sequence is encrypted and extracted, which not only ensures the security of the channel, but also enables the network time covert channel based on perceptual hashing to adapt to changes in network conditions, ensuring that the stability and reliability of communication can be maintained when network delays or interference occur, and comprehensively improving the performance of traditional covert channel construction technology, so that the network time covert channel constructed based on perceptual hashing has high robustness and security. Compared with the dynamic coding channel (TRCTC), the network time covert channel based on perceptual hashing constructed by the method proposed in this application shows a better degree of legitimate channel fitting, which is specifically manifested as follows: the covert channel detection method (GAS) based on long short-term memory network (LSTM) is used to detect the network time covert channel based on perceptual hashing and the dynamic coding channel respectively, and the detection scores of the two are compared. The receiver operating characteristic curve (ROC curve) is used to measure the detection scores of the two, and the area under the ROC curve and the coordinate axis (AUC) is calculated respectively. Figure 4 The AUC of the network time covert channel based on perceptual hashing using the embodiment of the present application is much smaller than the AUC of the dynamic coding channel. This is due to the fact that the present invention uses legitimate traffic for replay without changing the order, which can simulate the value range and regularity characteristics of the channel to a greater extent.

[0078] The above steps S1-S4 do not necessarily represent the order between the steps, but are represented by step symbols, and the order between the steps can be adjusted.

[0079] Further references Figure 5 As an implementation of the methods shown in the above figures, the present application provides an embodiment of a network time covert channel construction device based on perceptual hashing, and the device embodiment is similar to Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0080] The embodiment of the present application provides a network time covert channel construction device based on perceptual hashing, including:

[0081] The encoding module 1 is configured to obtain an inter-packet delay sequence of legitimate traffic of the public data set, and filter and encode the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence;

[0082] The spreading module 2 is configured to generate a spreading code with a length of N according to the key, and spread the plaintext according to the spreading code to obtain the spread plaintext;

[0083] The perceptual hash sequence generation module 3 is configured to search the first coding sequence according to the plaintext after spread spectrum to obtain a second coding sequence, and generate a perceptual hash sequence according to the second coding sequence and the first IPD sequence;

[0084] The perceptual hash sequence extraction module 4 is configured to restore the perceptual hash sequence according to the encoding rule and the spread spectrum code to obtain plain text.

[0085] Figure 6 Schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present invention. Figure 6 As shown, the electronic device of this embodiment includes: a processor 601 and a memory 602; wherein the memory 602 is used to store computer-executable instructions; the processor 601 is used to execute the computer-executable instructions stored in the memory to implement the various steps performed by the electronic device in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0086] Optionally, the memory 602 may be independent or integrated with the processor 601 .

[0087] When the memory 602 is independently provided, the electronic device further includes a bus 603 for connecting the memory 602 and the processor 601 .

[0088] The embodiment of the present invention further provides a computer storage medium, in which computer execution instructions are stored. When the processor 601 executes the computer execution instructions, the above method is implemented.

[0089] The embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by the processor 601, the above method is implemented.

[0090] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0091] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0092] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned module-composed unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0093] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor 601 to perform some steps of the methods of various embodiments of the present application.

[0094] It should be understood that the processor 601 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor 601 may be any conventional processor 601, etc. The steps of the method disclosed in the invention may be directly embodied in the execution of the hardware processor 601, or may be executed by a combination of hardware and software modules in the processor 601.

[0095] The memory 602 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.

[0096] The bus 603 may be an Industry Standard Architecture (ISA), a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 603 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 603 in the drawings of the present application is not limited to only one bus 603 or one type of bus 603.

[0097] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0098] An exemplary storage medium is coupled to the processor 601, so that the processor 601 can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor 601. The processor 601 and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor 601 and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0099] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network time covert channel construction method based on perceptual hashing, characterized in that: The following steps are involved: Acquire an inter-packet delay sequence of legitimate traffic of a public data set, and filter and encode the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence; Generate a spreading code with a length of N according to the key, and spread the plaintext according to the spreading code to obtain the spread plaintext; Searching the first coding sequence according to the spread plaintext to obtain a second coding sequence, and generating a perceptual hash sequence according to the second coding sequence and the first IPD sequence; The perceptual hash sequence is restored according to the encoding rule and the spread spectrum code to obtain plain text.

2. The method for constructing a network time covert channel based on perceptual hashing according to claim 1 is characterized in that: The step of obtaining an inter-packet delay sequence of legitimate traffic of the public data set, and filtering and encoding the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence specifically includes: Sort all the inter-packet delays of the inter-packet delay sequence from small to large to obtain a second IPD sequence; The filtering rule is as follows: the second IPD sequence is divided into a front coding area, a filtering area and a rear coding area, the inter-packet delay in the filtering area is filtered out, the first partition cutoff point of the front coding area and the filtering area is reserved, the second partition cutoff point of the filtering area and the rear coding area is reserved, and the order between the inter-packet delays in the inter-packet delay sequence is reserved, and the inter-packet delay of the front coding area, the first partition cutoff point, the second partition cutoff point and the inter-packet delay of the rear coding area constitute a third IPD sequence; The encoding rule is as follows: the inter-packet delay of the front coding area and the first partition cutoff point are encoded as 1, and the second partition cutoff point and the inter-packet delay of the rear coding area are encoded as -1, to obtain a third encoding sequence; The third IPD sequence and the third coding sequence are rearranged according to the order of the inter-packet delays in the inter-packet delay sequence to obtain a first IPD sequence and a first coding sequence, wherein the inter-packet delay of the first IPD sequence and the coding of the first coding sequence correspond one to one.

3. The method for constructing a network time covert channel based on perceptual hashing according to claim 2 is characterized in that: The step of searching the first coding sequence according to the spread plaintext to obtain the second coding sequence specifically includes: The spread-spectrum plaintext includes a plurality of spread-spectrum sequences, each of which has a length of N, each of which corresponds one-to-one to a plaintext bit of each spread-spectrum plaintext, and each of which is searched in the first coding sequence; When a code identical to the current spreading sequence is retrieved, the current spreading sequence retrieval is completed, and the current retrieval position is retained, and a sequence composed of all the retrieved codes is used as a fourth coding sequence; Searching for the next spreading sequence in the first coding sequence starting from the current search position; When the last bit of the first coding sequence is retrieved but the current spread spectrum sequence has not been retrieved, jump to the first bit of the first coding sequence and search the current spread spectrum sequence again; A second coding sequence is generated according to the fourth coding sequences corresponding to all the spreading sequences.

4. The method for constructing a network time covert channel based on perceptual hashing according to claim 3 is characterized in that: The generating of a perceptual hash sequence according to the second coding sequence and the first IPD sequence and sending the sequence specifically includes: retrieving the corresponding inter-packet delay in the first IPD sequence according to the second coding sequence, and using the sequence constituted by the retrieved inter-packet delay as the perceptual hash sequence corresponding to the plaintext after spread spectrum.

5. The method for constructing a network time covert channel based on perceptual hashing according to claim 2 is characterized in that: The restoring the perceptual hash sequence according to the encoding rule and the spreading code to obtain plain text specifically includes: Compare the inter-packet delays of all the perceptual hash sequences with the first partition cutoff point and the second partition cutoff point. If the inter-packet delay of the perceptual hash sequence is less than or equal to the first partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is 1. If the inter-packet delay of the perceptual hash sequence is greater than or equal to the second partition cutoff point, the code corresponding to the inter-packet delay of the perceptual hash sequence is -1, and a fifth coding sequence is obtained. The fifth coding sequence is divided into a plurality of sixth coding sequences with a length of N according to the length N of the spread spectrum code, and all the sixth coding sequences are multiplied by the spread spectrum code to obtain plain text.

6. The method for constructing a network time covert channel based on perceptual hashing according to claim 1 is characterized in that: The spread spectrum code is generated by using a nonlinear feedback shift register.

7. A network time covert channel construction device based on perceptual hashing, characterized in that: include: The encoding module is configured to obtain an inter-packet delay sequence of legitimate traffic of the public data set, and filter and encode the inter-packet delay sequence according to a set filtering rule and encoding rule to obtain a first IPD sequence and a first encoding sequence; A spreading module is configured to generate a spreading code with a length of N according to a key, and spread the plaintext according to the spreading code to obtain the spread plaintext; a perceptual hash sequence generation module, configured to search the first coded sequence according to the spread plaintext to obtain a second coded sequence, and generate a perceptual hash sequence according to the second coded sequence and the first IPD sequence; The perceptual hash sequence extraction module is configured to restore the perceptual hash sequence according to the encoding rule and the spread spectrum code to obtain plain text.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images