A method for deploying trap nodes in Tor anonymity networks based on multi-objective optimization and randomized confusion

Abstract

This invention proposes a method for deploying trap nodes in a Tor anonymous network based on a multi-objective optimization algorithm and randomized obfuscation. Specifically, it includes: collecting node consensus files and server descriptor files from a Tor directory server; collecting node statistics from the Tor Metrics website for subsequent steps; establishing several circuit connections within a time period and using the Tor control protocol to query node and link information within the circuits to construct a local connectivity graph; calculating node centrality metric scores and their time-series averages as the monitoring scope of nodes in the graph; selecting the monitoring scope, selection probability, and deployment cost of a node as the objective function to be optimized, using a multi-objective optimization algorithm to calculate the Pareto optimal solution, and using the node information within it as the locally optimal deployment scheme; and performing feature obfuscation on the locally optimal deployment scheme from both the statistical information and behavioral perspectives of the nodes, resulting in the final trap node deployment scheme.

Description

Technical Field

[0001] This application relates to the field of network security, specifically to a Tor trap node deployment method based on multi-objective optimization and node feature obfuscation. Background Technology

[0002] With the advancement of technology, computer networks are developing rapidly at an unprecedented pace. While enjoying the convenience brought by the Internet of Things, people also face the risk of personal privacy leaks. To achieve personal privacy protection and censorship avoidance, anonymous communication networks have emerged. Low-latency anonymous communication systems, represented by Tor, JAP, and I2P, are widely used in various aspects of the Internet. Among them, Tor (The Second Generation Onion Router) is currently the most widely used anonymous network with the largest user base. It uses a multi-hop proxy mechanism to encrypt and protect the communication process; uses a directory authority to store the global network state; uses the SOCKS protocol as an anonymous proxy for the application layer protocol; and provides client anonymity to protect user privacy while providing a hidden service to ensure the anonymity of the receiver (i.e., the service provider). It can provide network services while ensuring that the server IP address is not leaked.

[0003] While Tor offers low latency and versatility, its high anonymity and strong resistance to tracing are increasingly being used to spread sensitive information and as a springboard for cyberattacks. Tracing the origin of nodes in anonymous networks is particularly important in anonymous network governance. If the entry and exit nodes of a Tor circuit can be successfully controlled, deanonymization attacks on the sender can be performed through packet comparison, achieving tracing. However, Tor's multi-hop proxy mechanism presents challenges for traffic correlation analysis. To achieve tracing, implanting trap nodes in Tor anonymous networks is a feasible solution. Existing research has made trap nodes the RP nodes and entry nodes in the circuit, and used intersection attacks to trace the IP addresses of hidden services. Therefore, deploying trap nodes is extremely important for tracing anonymous communications; furthermore, increasing the probability of trap nodes being selected, balancing deployment costs and the monitoring scope of trap nodes, and ensuring the anonymity and survival rate of trap nodes are current research challenges.

[0004] This invention proposes an anonymous network trap node deployment method based on a multi-objective optimization algorithm and node feature obfuscation. Specifically, it includes: collecting node consensus files and server descriptor files from a Tor directory server, and collecting node statistics from the TorMetrics website to construct a local knowledge base; establishing several Tor circuit connections within a time period, and using the Tor control protocol to query node and link information in the circuits to construct a Tor local connectivity graph; calculating node centrality scores using multiple centrality measurement methods and calculating their time-series average as the monitoring scope of nodes in the anonymous network's local connectivity graph; selecting the monitoring scope of relay nodes, the probability of relay nodes being selected, and deployment cost as the objective functions to be optimized, using the multi-objective optimization algorithm NSGA-II to calculate the Pareto optimal solution, and using the node information from this solution as the locally optimal deployment scheme; and performing feature obfuscation on the locally optimal deployment scheme from both the statistical information and behavioral perspectives of the relay nodes to obtain the final trap node deployment scheme. Summary of the Invention

[0005] In view of this, this invention proposes a method for deploying trap nodes in Tor anonymous networks based on multi-objective optimization and randomized obfuscation. This method can effectively deploy trap nodes in Tor networks and collect traffic information, providing support for tracing and tracking anonymous communications.

[0006] A method for deploying anonymous network trap nodes based on multi-objective optimization and randomized obfuscation, the method comprising:

[0007] Step 1: Construct a local connectivity graph of the Tor anonymous network using the Tor control protocol;

[0008] Step 2: Calculate the monitoring field of view of nodes in the local connectivity graph of the anonymous network;

[0009] Step 3: Obtain the Pareto optimal solution for the Tor network trap node deployment scheme based on the multi-objective optimization algorithm, and use it as the basis for deploying trap nodes;

[0010] Step 4: Improve the anti-detection capability of trap nodes based on randomization obfuscation;

[0011] Step 5: Using the obtained locally optimal deployment scheme, deploy trap nodes in the Tor anonymous network.

[0012] Preferably, in step 1, the process of constructing the local connectivity graph of the anonymous network includes:

[0013] Use web crawlers to periodically scrape consensus files and server descriptor files from the Tor authoritative directory management authority;

[0014] Use the list of available nodes in the consensus file as the graph. Nodes in Use the node's server descriptor as the node's identifier; select Composed of IP addresses of popular hidden services and common domains in the Alexa Top 100. ;use A local server as Set up its Tor client on all local servers;

[0015] Initialize the local connectivity graph of the anonymous network, where , , ;

[0016] Select time period The time period Depend on It consists of several time slices; using the Tor control protocol, control protocol signals are sent to the Tor client, instructing the local server... and A Tor circuit is established between them; the Tor circuit is composed of guard nodes, intermediate nodes and exit nodes selected from the list of available nodes in the consensus file by the Tor client through an adjustable bandwidth weighted routing algorithm;

[0017] Repeat the above steps to continuously acquire new Tor circuit connections until the time period ends. End; in time slice In the process, the Tor control protocol queries all established circuits to obtain the server descriptor of the relay node, and uses this descriptor to look up the IP address of the relay node from the consensus file; the time slice is represented in the format <relay node IP, relay node IP, time slice number>. Zhongtong Liantu An edge; the network connectivity graph is obtained by using the IP addresses of relay nodes as nodes and the link connections between relay nodes as edges.

[0018] Preferably, in step 2, the process of calculating the monitoring field of view of nodes in the local connectivity graph of the Tor anonymity network includes:

[0019] For local connectivity graphs The centrality metric is calculated for each relay node. The centrality metric methods include node degree centrality, Katz centrality, proximity centrality, harmony centrality, and the weighted PageRank algorithm.

[0020] The degree centrality of each relay node is calculated using the following formula:

[0021]

[0022] in Represents a node Degree in the network, This indicates the size of the network, i.e., the number of nodes.

[0023] The Katz centrality of each relay node is calculated using the following formula:

[0024]

[0025] in Let be the adjacency matrix of the network. The attenuation factor must have a value less than 1. The reciprocal of the absolute value of the largest eigenvalue;

[0026] The proximity centrality of each relay node is calculated using the following formula:

[0027]

[0028] in, Represents a node and The distance between them This indicates the size of the network, i.e., the number of nodes.

[0029] The harmony centrality of each relay node is calculated using the following formula:

[0030]

[0031] in It is a node and The distance between them This indicates the size of the network, i.e., the number of nodes.

[0032] The weighted PageRank score for each relay node is calculated using the following formula:

[0033]

[0034] in, This indicates the size of the network, i.e., the number of nodes. It is the damping coefficient in the PageRank score. It is a node To the node The weight of the edge. It is with nodes A set of connected nodes;

[0035] The various centrality scores are normalized using the following formula:

[0036]

[0037] in, A certain type of centrality score representing a relay node. The set of centrality scores representing relay nodes. This represents the centrality score after normalization.

[0038] And calculate the average of the centrality scores as the relay nodes. Centrality measure score ;

[0039] After a certain time period ends, count the total number of nodes in the Tor local network connectivity graph at that time. and each time slice Nodes in centrality score The temporal centrality score of a node is calculated using the following formula:

[0040]

[0041] The node The temporal centrality score represents the monitoring scope of the node in the local connectivity graph of the Tor anonymous network.

[0042] Preferably, in step 3, the method for determining the Tor trap node deployment scheme based on multi-objective optimization includes:

[0043] A random walk is performed on the local connectivity graph of the anonymous network described in step 2 to generate... There are several node selection schemes, each containing... Each node; calculates the monitoring scope of each node in each scheme, and obtains the bandwidth value of the node from the consensus file;

[0044] Using the monitoring scope of relay nodes, the probability of relay nodes being selected, and deployment cost as the objective functions to be optimized, they are expressed as follows: :

[0045]

[0046]

[0047]

[0048] Minimizing the values ​​of three objective functions is the optimization objective; therefore, each objective function is negatively represented. Representing the The negative sum of the temporal centrality scores of each deployment scheme is used to represent the overall Tor network monitoring scope of that deployment scheme.

[0049] Representing the In a trap node deployment scheme under an adjustable bandwidth routing algorithm, the sum of the probabilities of a node being selected as a relay node for circuit construction is negative.

[0050] Representative deployment of the first The negative of the total cost of the trap node deployment scheme, where A parameter representing a direct proportionality between cost and bandwidth capability;

[0051] Using the NSGA-II algorithm, based on the Pareto dominance principle, a deployment scheme is adopted for each node. For each of the three objective functions, the solutions are compared with other solutions. If the solution satisfies the requirements for all objective functions... All less than or equal to And at least on one objective function, Strictly less than ,Right now:

[0052]

[0053]

[0054] Then the plan Dominate , and record as If the trap node deployment scheme For all other deployment schemes All satisfied ,but If a Pareto optimal solution is found, the solution is saved to the Pareto optimal solution set. The above operation is continued for the remaining deployment solutions until there is no Pareto optimal solution in the initial set of trap node deployment solutions.

[0055] The Pareto optimal solution sets are merged, and duplicate relay nodes are removed. and The nodes in the diagram are used to obtain a locally optimal trap node deployment scheme.

[0056] Preferably, in step 4, the Tor trap node anti-detection method based on randomized obfuscation includes:

[0057] Use web crawlers to collect various statistics and performance data of the Tor network from the Tor Metrics website;

[0058] In the anonymous network local connectivity graph described in step 2, the IP home locations of relay nodes are statistically analyzed to obtain the top 15 regions in terms of the number of home locations. For each node in the trap node deployment scheme, a random selection is made from the regions to serve as the IP home location of that node, and a suitable VPS is selected from multiple cloud service providers.

[0059] Using data from Tor Metrics, we statistically analyze the distribution percentages of relay node nicknames, ports, and client versions within a given time period, and select the parameter with the highest percentage as the configuration for trap nodes.

[0060] The runtime of the trap node is randomized and obfuscated. Before deploying the trap node, the average uptime of relay nodes newly added to the Tor network in the past 7 hours is calculated and denoted as . This represents the floating uptime of newly added relay nodes in the Tor network; the average uptime of relay nodes newly added to the Tor network over the past 7 days is denoted as . This represents the stable uptime of a newly added relay node in the Tor network, and is calculated as follows: ;

[0061] Calculate the number of trap nodes that are running normally each hour (i.e. The probability mass function of the Poisson distribution. ,in The value range is the number of nodes N in the trap node deployment scheme set in step 3, as shown in the following formula:

[0062]

[0063] The calculated Poisson distribution includes the number of trap nodes operating normally per hour. Its corresponding probability value Based on this probability distribution, the number of trap nodes that are running normally within the current hour is randomly selected.

[0064] Preferably, in step 5, the method for deploying trap nodes in the Tor anonymity network based on a locally optimal deployment scheme includes:

[0065] Using the locally optimal trap node deployment scheme described in step 3, determine the bandwidth capacity and outbound traffic strategy of the trap nodes; using the randomization obfuscation method described in step 4, obfuscate the external characteristics of the relay nodes to determine the IP address, nickname, Tor port, and Tor client version of the trap nodes; using the Poisson distribution described in step 4, after deploying the trap nodes in the Tor anonymity network, dynamically adjust the number of normally operating trap nodes every hour. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0067] Figure 1 This is a flowchart illustrating a Tor anonymous network trap node deployment method based on multi-objective optimization and randomized obfuscation, according to an embodiment of the present invention.

[0068] Figure 2 The Poisson distribution parameters in this embodiment of the invention A schematic diagram of the probability mass function curve at time t. Detailed Implementation

[0069] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. The following embodiments or drawings are used in the present invention, but are not intended to limit the scope of the present invention.

[0070] See Figure 1 , Figure 1 A flowchart of a Tor anonymity network trap node deployment method based on multi-objective optimization and randomized obfuscation provided in this application embodiment includes:

[0071] Step 1: Construct a local connectivity graph of the Tor anonymous network using the Tor control protocol;

[0072] Step 2: Calculate the temporal centrality scores of nodes in the local connectivity graph of the Tor anonymous network;

[0073] Step 3: Obtain the Pareto optimal solution for the Tor network trap node deployment scheme based on multiple objectives, and use it as the basis for deploying trap nodes;

[0074] Step 4: Improve the anti-detection capability of trap nodes based on randomization obfuscation;

[0075] Step 5: Deploy trap nodes in the Tor anonymous network using a locally optimal deployment scheme.

[0076] The specific steps for constructing a local connectivity graph of an anonymous network include:

[0077] Step 1a: In an embodiment of the present invention, the directory server with the most running relay nodes is selected from the eight directory servers of the Tor Authorities, and the consensus document and server descriptor file are obtained from it in a time slice of one hour.

[0078] Step 1b: Use the list of available nodes in the consensus file As nodes in the graph, the relay node server descriptor is used as the node's identifier; the IP addresses of several highly popular hidden services and common websites in the Alexa Top 100 are selected to form the identifier. Use several local servers Tor clients were set up on all the servers; the connectivity graph was initialized. ,in ;

[0079] Optionally, to reduce the computational scale, some nodes in the list of available nodes can be selected as nodes in the graph; for example, 30% of the available nodes can be randomly selected to form the nodes in the local anonymous network connectivity graph.

[0080] Step 1c: Select a time period and divide it into A continuous time slice, i.e. Based on the Tor Control Protocol, control protocol signals are sent to Tor itself, instructing the local server... and A Tor circuit is established between them; Tor clients will select routes from the Tor network based on an adjustable bandwidth-weighted routing algorithm. Three relay nodes are randomly selected to construct a Tor circuit;

[0081] For example, set the time period T to 96 hours and divide it into 96 consecutive time slices, each time slice being 1 hour;

[0082] Preferably, the Python Stem library is used as the control library for interacting with Tor clients. Stem can obtain detailed information about each node in the Tor network through Tor control protocol signals, including the node's IP address, port, bandwidth, role (such as egress node or ingress node), etc.

[0083] Step 1d: Repeat step 1c to continuously acquire new Tor circuit connections; in the time slice In this process, each time a new Tor circuit is created, the Tor client maintains information on three alternative circuits. The Python Stem library is used to query the server descriptor of each relay node in the circuit, and based on this server descriptor, detailed information about the relay node is retrieved from the server descriptor files published by the Tor Project. This information includes the node's IP address, bandwidth capacity, Tor client version, open port information, node nickname, and descriptive fingerprint. Time slices are generated using the format <relay node IP, relay node IP, time slice number>. In the Tor local network connectivity diagram One edge in the network; the network connectivity graph is obtained by using the IP addresses of relay nodes as nodes and the link connections between relay nodes as edges;

[0084] For example, in time slices In the process, the user receives a link information response. Then the edge set Add edges and And the connection between the local server node and the guard node. The connection between the export node and the remote server Repeat the above operation in each time slice until time... End. Construct a locally connected graph G of the anonymous network. At this point, the number of nodes and edges in graph G is at its maximum.

[0085] The specific steps for calculating the monitoring field of view of nodes in the local connectivity graph of an anonymous network are as follows:

[0086] Step 2a: Calculate the temporal centrality score for each relay node in the local connectivity graph G. The centrality measurement methods include node degree centrality, Katz centrality, proximity centrality, and harmony centrality measurement methods.

[0087] Step 2b: Calculate the degree centrality of each relay node. The formula is as follows:

[0088]

[0089] in Represents a node Degree in the network, This indicates the size of the network, i.e., the number of nodes.

[0090] Step 2c: Calculate the Katz centrality for each relay node. The formula is as follows:

[0091]

[0092] in Let be the adjacency matrix of the network. The attenuation factor must have a value less than 1. The reciprocal of the absolute value of the largest eigenvalue.

[0093] Step 2d: Calculate the proximity centrality for each relay node. The formula is as follows:

[0094]

[0095] in, Represents a node and The distance between them This indicates the size of the network, i.e., the number of nodes.

[0096] Step 2e: Calculate the harmony centrality for each relay node, using the following formula:

[0097]

[0098] in It is a node and The distance between them This indicates the size of the network, i.e., the number of nodes.

[0099] Step 2f: Calculate the weighted PageRank score for each relay node using the following formula:

[0100]

[0101] in, This indicates the size of the network, i.e., the number of nodes. It is the damping coefficient in the PageRank score. It is a node To the node The weight of the edge. It is with nodes A set of connected nodes.

[0102] Step 2g: First, perform minimum-maximum normalization on the various centrality fractions. The normalization formula is as follows:

[0103]

[0104] in, A certain type of centrality score representing a relay node. The set of centrality scores representing all relay nodes;

[0105] And calculate the average of the centrality scores as the relay nodes. centrality score .

[0106] Step 2h: Calculate the temporal centrality scores of nodes in the local connectivity graph of the Tor anonymous network; within the time period After completion, count the total number of nodes in the locally connected graph at this point. and each time slice Nodes in centrality score The temporal centrality score of a node is calculated using the following formula:

[0107]

[0108] Optionally, it can be within a time period Optional A time slice to Calculate the nodes within this time period Time centrality score:

[0109]

[0110] The calculated time centrality score is used as the node. The monitoring field of view.

[0111] The specific steps for determining the Tor trap node deployment scheme based on multi-objective optimization are as follows:

[0112] Step 3a: Initialize individuals, select nodes from the local connectivity graph of the anonymous network described in Step 1d using a random walk algorithm, and generate M node selection schemes, where each scheme contains N nodes; for each scheme, calculate the centrality scores of each node and query the bandwidth capacity of the nodes from the consensus file;

[0113] For example, the number of node selection schemes M is set to 15; the number of nodes in each scheme is set to 30% of the total number of nodes in the local connected graph G of the Tor anonymous network. A random walk is performed starting from the node with the largest in-degree in G, and an outgoing edge is randomly selected to reach the next node. If the current node has no outgoing degree, a random jump is performed. Each time a new node is visited, its result is added to the set S, until the walk terminates when the Nth node is visited.

[0114] Step 3b: Select three metrics as the objective function to be optimized: local monitoring scope of the Tor network, probability of relay nodes being selected, and deployment cost. Here, the objective function is transformed into a three-dimensional vector. ;in:

[0115]

[0116]

[0117]

[0118] We choose minimization as the optimization objective, and take the negative of all three objective functions; among them, Representing the The negative sum of the temporal centrality scores of each trap node deployment scheme is used to represent the overall Tor network monitoring scope of that deployment scheme.

[0119] Representing the The sum of the probabilities of each trap node deployment scheme being selected as a relay node for circuit construction under the adjustable bandwidth routing algorithm (this algorithm uses node bandwidth information provided in the Tor consensus file for calculation), where different calculation methods are used depending on the node type (Guard, Intermediate, Exit); Indicates the first in the current deployment plan Bandwidth of each node This indicates the total bandwidth of nodes marked with the Exit flag. This represents the total bandwidth of nodes marked with the "Guard" logo. This represents the total bandwidth of nodes marked with the Guard and Exit flags. This represents the total bandwidth of nodes without the Guard and Exit flags. These represent the weights of the ingress protection node and the egress protection node, respectively.

[0120] Representative deployment of the first The negative of the total cost of the trap node deployment scheme, where A parameter representing a direct proportionality between cost and bandwidth capability;

[0121] Preferably, a proportional parameter is obtained by statistically analyzing the bandwidth capacity and price of existing cloud servers. .

[0122] Step 3c: Using the NSGA-II algorithm, based on the Pareto dominance principle, deploy a scheme for each node. For the three elements in the objective function The node deployment scheme is compared with other schemes respectively. If it satisfies the requirements of all objective functions... All less than or equal to And at least on one objective function, Strictly less than ,Right now:

[0123]

[0124]

[0125] Then the plan Dominate , and record as If the trap node deployment scheme For all other deployment schemes All satisfied ,but If the solution is Pareto optimal, save it to the Pareto optimal trap node deployment scheme set. Continue to perform the above operation on the remaining deployment schemes until there is no Pareto optimal solution in the initial trap node deployment scheme set.

[0126] The Pareto optimal trap node deployment schemes are merged, and duplicate relay nodes are removed. and The nodes in the diagram are used to obtain a locally optimal trap node deployment scheme.

[0127] The specific steps for the Tor trap node anti-detection method based on randomized obfuscation are as follows:

[0128] Step 4a: Select a time period and use a web crawler to collect information such as node nicknames, open ports, and client versions of active nodes in the Tor network from the Tor Metrics website; for the running relay node information in the available node list in the consensus file, obtain the corresponding information according to the fields therein;

[0129] For example, the information corresponding to each field is as follows:

[0130] v corresponds to the Tor client version running on the relay node;

[0131] pr corresponds to the supported protocol types and versions; w corresponds to the bandwidth capacity of the relay node.

[0132] p corresponds to the outbound traffic policy of the relay node, indicating which ports are allowed to receive traffic;

[0133] r corresponds to the basic information of the relay node, including the relay node's nickname, identity fingerprint, description fingerprint, descriptor publication time, routing port, and directory port.

[0134] 'a' corresponds to the IPv6 address and port of the relay node;

[0135] s corresponds to the status flag of the relay node.

[0136] Step 4b: Statistically analyze the IP addresses of relay nodes in the Tor local connectivity graph described in Step 1d, and obtain the top 15 regions in terms of the number of IP addresses; randomly select one of these regions as the IP address of the trap node, and select a suitable VPS (virtual private servers) from multiple cloud service provider platforms.

[0137] Step 4c: Based on the data on Tor Metric, calculate the distribution ratio of relay node nicknames, ports, and Tor client versions over a recent period (e.g., within the last week). Calculate the parameters with the highest percentage and use them as the configuration for trap nodes to obfuscate the trap nodes based on their characteristics.

[0138] Step 4d: Randomize and obfuscate the runtime of the trap nodes. Before deploying the trap nodes, calculate the average uptime of relay nodes newly added to the Tor network in the past 7 hours, and record it as _____. This represents the floating uptime of newly added relay nodes in the Tor network; the average uptime of relay nodes newly added to the Tor network over the past 7 days is denoted as . This represents the stable uptime of a newly added relay node in the Tor network, and is calculated as follows: .

[0139] Step 4e: Calculate the number of trap nodes that are running normally each hour (i.e. The probability mass function of the Poisson distribution. ,in The value range is the number of nodes N in the trap node deployment scheme set in step 3a, as shown in the following formula:

[0140]

[0141] The calculated Poisson distribution includes the number of trap nodes operating normally per hour. Its corresponding probability value Based on this probability distribution, the number of trap nodes that are running normally within the current hour is randomly selected;

[0142] like Figure 2 As shown, the parameters described in step 4d It will dynamically adjust based on the activity level of Tor network nodes: when short-term activity is high, The value will decrease, at which point the overall curve of the probability mass function will be steeper, and the number of trap nodes operating normally per hour will change drastically; when short-term activity is low... The value will increase, and the overall function curve of the probability quality function will be relatively flat, and the number of trap nodes that are running normally per hour will change relatively steadily; in this way, the behavioral characteristics of trap nodes are hidden among the normal nodes of the Tor network.

[0143] The specific steps for deploying trap nodes in the Tor network are as follows:

[0144] Step 5a: Using the anonymous network local connectivity graph optimization deployment scheme described in Step 3c, determine the bandwidth capacity and outbound traffic strategy of the trap node; using the randomization obfuscation method described in Steps 4b and 4c, determine the IP address, nickname, Tor port, and Tor client version of the trap node.

[0145] Step 5b: When starting to deploy the trap node, calculate the Poisson distribution parameters according to the method described in Step 4d. Calculate the Poisson distribution of the number of normally operating trap nodes per hour based on step 4e, and set the number of normally operating trap nodes in the current hour based on this probability distribution; repeat steps 4d and 4e every hour to recalculate. and Based on the obtained probability distribution, the number of trap nodes that are running normally in the current hour is set, and the Tor client on the trap node is dynamically started or stopped according to the number of trap nodes that are running normally in the previous hour.

[0146] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technologies.

[0147] Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this invention shall be included within the scope of protection of this invention.

Claims

1. A method for deploying trap nodes in a Tor anonymity network based on multi-objective optimization and randomized confusion, characterized in that, The method includes: Step 1. Construct a local connectivity graph of the Tor anonymous network based on the Tor control protocol; Periodically crawl consensus files and server descriptors from the Tor authoritative directory management authority to obtain a set of available relay nodes. ; Select A collection consisting of IP addresses of highly popular hidden services and Alexa Top 100 domains. ;exist A collection of Tor clients running on local servers. ;by Initialize the edge set for the vertex set. ; In the A time period composed of time slices Internally, the local client communicates with the Tor control protocol. The nodes in the graph are used to build Tor circuits one by one, and the actual relay IPs and connection timings used by each circuit are recorded. The edge set is dynamically filled in the form of triples of <relay node IP, relay node IP, time slice number>, and finally the local connectivity graph that evolves over time is obtained. ; Step 2. Calculate the monitoring field of view of nodes in the local connectivity graph of the Tor anonymous network; For local connectivity graphs Calculate the degree centrality of each relay node in turn. Katz centrality Proximity centrality Harmony Centrality and weighted PageRank value After normalizing the five centrality scores mentioned above and taking the average, the node values ​​are obtained. Centrality metric score in this time slice ; During the complete time period After it's over, press Calculate the time series centrality score, in order to As a node The surveillance field of view, among which The number of nodes in the local connectivity graph of the Tor anonymous network; Step 3. Obtain the Pareto optimal solution for the trap node deployment scheme based on a multi-objective optimization algorithm, and use it as the basis for deploying trap nodes; exist Random walk generation is performed on top There are 10 candidate deployment schemes, and each scheme selects... One node; With the plan The total negative number of the monitored field of view The sum of the probabilities of a node being selected by a bandwidth-weighted route is negative. And negative deployment costs To optimize the objective, the NSGA-II algorithm is used to solve multiple objectives, retaining non-dominated solutions that satisfy the Pareto dominance relation, merging and deduplicating them to form a locally optimal trap node deployment scheme; Step 4. Improve the anti-detection capability of trap nodes based on randomization obfuscation; The Tor Metrics website was used to analyze the distribution of the most frequent relay nodes by nickname, port, client version, and uptime in recent periods. The IP addresses of each trap node in the deployment were randomly assigned to the top 15 regions with the highest concentration of Tor network nodes, and VPS resources in the corresponding regions were selected. Based on the above statistical results, the trap nodes' nicknames, ports, client versions, and uptime were set according to a Poisson distribution. Activate every hour Each node is configured to behave in a manner consistent with the real new relay node. Step 5. Using the obtained locally optimal deployment scheme, deploy trap nodes in the Tor anonymity network; Using the locally optimal trap node deployment scheme described in step 3, determine the bandwidth capacity and outbound traffic strategy of the trap nodes; using the randomization obfuscation method described in step 4, obfuscate the external characteristics of the relay nodes to determine the IP address, nickname, Tor port, and Tor client version of the trap nodes; using the Poisson distribution described in step 4, after deploying the trap nodes in the Tor anonymity network, dynamically adjust the number of normally operating trap nodes every hour.

2. The method for deploying trap nodes in a Tor anonymity network based on multi-objective optimization and randomized confusion as described in claim 1, characterized in that, Step 1 includes: Use web crawlers to periodically scrape consensus files and server descriptor files from the Tor authoritative directory management authority; Use the list of available nodes in the consensus file as the graph. Nodes in Use the node's server descriptor as the node's identifier; select Composed of IP addresses of popular hidden services and common domains in the Alexa Top 100. ;use A local server as Set up its Tor client on all local servers; Initialize the local connectivity graph of the anonymous network, where , , ; Select time period The time period Depend on It consists of several time slices; using the Tor control protocol, control protocol signals are sent to the Tor client, instructing the local server... and A Tor circuit is established between them; the Tor circuit is composed of guard nodes, intermediate nodes and exit nodes selected from the list of available nodes in the consensus file by the Tor client through an adjustable bandwidth weighted routing algorithm; Repeat the above steps to continuously acquire new Tor circuit connections until the time period ends. End; in time slice In the process, the Tor control protocol queries all established circuits to obtain the server descriptor of the relay node, and uses this descriptor to look up the IP address of the relay node from the consensus file; the time slice is represented in the format <relay node IP, relay node IP, time slice number>. Zhongtong Liantu An edge; the local connectivity graph is obtained by using the relay node IP address as the node and the relay node link connection relationship as the edge.

3. The method for deploying trap nodes in a Tor anonymity network based on multi-objective optimization and randomized confusion as described in claim 1, characterized in that, Step 2 includes: For local connectivity graphs The centrality metric is calculated for each relay node. The centrality metric methods include node degree centrality, Katz centrality, proximity centrality, harmony centrality, and the weighted PageRank algorithm. The degree centrality of each relay node is calculated using the following formula: in Represents a node Degree in the network, This indicates the size of the network, i.e., the number of nodes. The Katz centrality of each relay node is calculated using the following formula: in Let be the adjacency matrix of the network. The attenuation factor must have a value less than 1. The reciprocal of the absolute value of the largest eigenvalue; The proximity centrality of each relay node is calculated using the following formula: in, Represents a node and The distance between them This indicates the size of the network, i.e., the number of nodes. The harmony centrality of each relay node is calculated using the following formula: in It is a node and The distance between them This indicates the size of the network, i.e., the number of nodes. The weighted PageRank score for each relay node is calculated using the following formula: in, This indicates the size of the network, i.e., the number of nodes. It is the damping coefficient in the PageRank score. It is a node To the node The weight of the edge. It is with nodes A set of connected nodes; The various centrality scores are normalized using the following formula: in, A certain type of centrality score representing a relay node. The set of centrality scores representing relay nodes. This represents the centrality score after normalization. And calculate the average of the centrality scores as the relay nodes. Centrality measure score ; After a certain time period ends, count the total number of nodes in the Tor local network connectivity graph at that time. and each time slice Nodes in centrality score The temporal centrality score of a node is calculated using the following formula: The node The temporal centrality score represents the monitoring scope of the node in the local connectivity graph of the Tor anonymous network.

4. The method for deploying trap nodes in a Tor anonymity network based on multi-objective optimization and randomized confusion as described in claim 1, characterized in that, Step 3 includes: A random walk is performed on the local connectivity graph of the anonymous network described in step 2 to generate... There are several node selection schemes, each containing... Each node; calculates the monitoring scope of each node in each scheme, and obtains the bandwidth value of the node from the consensus file; Using the monitoring scope of relay nodes, the probability of relay nodes being selected, and deployment cost as the objective functions to be optimized, they are expressed as follows: : Minimizing the values ​​of three objective functions is the optimization objective; therefore, each objective function is negatively represented. Representing the The negative sum of the time-series centrality scores of each deployment scheme is used to represent the overall Tor network monitoring scope of that deployment scheme. Representing the In a trap node deployment scheme under an adjustable bandwidth routing algorithm, the sum of the probabilities of a node being selected as a relay node for circuit construction is negative; where... Indicates the first in the current deployment plan Bandwidth of each node This indicates the total bandwidth of nodes marked with the Exit flag. This represents the total bandwidth of nodes marked with the "Guard" logo. This represents the total bandwidth of nodes marked with the Guard and Exit flags. This represents the total bandwidth of nodes without the Guard and Exit flags. These represent the weights of the ingress protection node and the egress protection node, respectively. Representative deployment of the first The negative of the total cost of the trap node deployment scheme, where A parameter representing a direct proportionality between cost and bandwidth capability; Using the NSGA-II algorithm, based on the Pareto dominance principle, a deployment scheme is adopted for each node. For each of the three objective functions, the solutions are compared with other solutions. If the solution satisfies the requirements for all objective functions... All less than or equal to And at least on one objective function, Strictly less than ,Right now: Then the plan Dominate , and record as If the trap node deployment scheme For all other deployment schemes All satisfied ,but If a Pareto optimal solution is found, the solution is saved to the Pareto optimal solution set. The above operation is continued for the remaining deployment solutions until there is no Pareto optimal solution in the initial set of trap node deployment solutions. The Pareto optimal solution sets are merged, and duplicate relay nodes are removed. and The nodes in the diagram are used to obtain a locally optimal trap node deployment scheme.

5. The method for deploying trap nodes in a Tor anonymity network based on multi-objective optimization and randomized confusion as described in claim 1, characterized in that, Step 4 includes: Use web crawlers to collect various statistical information and performance data of the Tor network from the Tor Metrics website; In the anonymous network local connectivity graph described in step 2, the IP home locations of relay nodes are statistically analyzed to obtain the top 15 regions in terms of the number of home locations. For each node in the trap node deployment scheme, a random selection is made from the regions to serve as the IP home location of that node, and a suitable VPS is selected from multiple cloud service providers. Using data from Tor Metrics, we statistically analyze the distribution percentages of relay node nicknames, ports, and client versions within a given time period, and select the parameter with the highest percentage as the configuration for trap nodes. The runtime of the trap node is randomized and obfuscated. Before deploying the trap node, the average uptime of relay nodes newly added to the Tor network in the past 7 hours is calculated and denoted as . This represents the floating uptime of newly added relay nodes in the Tor network; the average uptime of relay nodes newly added to the Tor network over the past 7 days is denoted as . This represents the stable uptime of a newly added relay node in the Tor network, and is calculated as follows: ; Calculate the number of trap nodes that are running normally each hour. The probability mass function of the Poisson distribution ,in The value range is the number of nodes N in the trap node deployment scheme set in step 3, as shown in the following formula: The calculated Poisson distribution includes the number of trap nodes operating normally per hour. Its corresponding probability value Based on this probability distribution, the number of trap nodes that are running normally within the current hour is randomly selected.

Images