A watermark embedding method, detection method and device for Tor network flow

Abstract

The present invention provides a watermark embedding method, detection method, and device for Tor network flows. The watermark embedding end divides the data flow into time slot blocks according to the product of the redundancy of the watermark to be embedded and the number of bits. The first two time slots of the time slot block are used as basic time slots to generate dynamic basic watermark bits, and the remaining time slots are used as embedded time slots to add watermarks. A watermark signal is constructed based on redundant coding and basic watermark bits. The embedded time slot portion of each time slot block is distinguished by adding a delay to the even time slot group or the odd time slot group to adjust the expected value of the centroid difference of the odd and even time slot groups to embed a watermark bit. After the time slot blocks are divided, the watermark detection end distinguishes between the basic time slot and the embedded time slot. The real embedded watermark bit is detected by calculating the expected value of the centroid difference of the odd and even time slot groups in the embedded time slot. The watermark error correction code bits are restored and a complete watermark error correction code is obtained. The original watermark signal is extracted based on a shared subscript vector, reducing the interference of a complex network environment on the statistical characteristics of the network flow.

Description

Technical Field

[0001] The present invention relates to the technical field of network data processing, and in particular to a watermark embedding method, a detection method and a device for Tor network flows. Background Art

[0002] The widespread use of the Tor network (onion network) provides a covert environment for cybercrime, making determining the relationship between communicating parties a key aspect of network security. Early passive traffic analysis techniques deployed sniffing nodes to analyze traffic characteristics and match data flows. However, this required processing large amounts of traffic, incurred high overhead, and was susceptible to interference. This led to the emergence of network stream watermarking, a type of active traffic analysis technology. This technology draws on the concept of digital watermarking, modulating traffic characteristics upstream to embed a watermark, and then detecting and determining communication relationships downstream.

[0003] Early passive traffic analysis techniques deployed sniffing observation nodes at key locations in the network. These nodes analyzed and compared the timing characteristics, packet lengths, and data grouping of a large number of intercepted network flows on both sides to match data flows. Using specific similarity calculation algorithms, they further determined the homology of the flows. This passive traffic homology identification technology required capturing and processing all network traffic, which introduced time and space overhead for network equipment. Furthermore, long-term, large-scale network flow analysis not only required a large number of samples for pre-training, but was also susceptible to interference from various flow adjustments in complex network environments, affecting the accuracy of the results. Summary of the Invention

[0004] In view of this, the embodiments of the present invention provide a watermark embedding method, a detection method and an apparatus for Tor network streams, so as to eliminate or improve one or more defects existing in the prior art, and solve the problem that the prior art has too large time and space overhead in the process of identifying homology relationships in Tor network data streams and cannot cope with interference from complex network environments.

[0005] The present invention provides a watermark embedding method for a Tor network stream, the method being used to be executed at a watermark embedding end of the Tor network, and the method comprising the following steps:

[0006] Dividing the data stream to be processed into a first number of time slot blocks after a first set time offset, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; dividing each time slot block into a plurality of time slots according to a first time length, with the first two time slots in each time slot block serving as basic time slots and the remaining time slots serving as embedding time slots; and determining a basic watermark bit according to a transmission rate of the stream within the basic time slot;

[0007] For each bit in the watermark signal, randomly select a second number of embedding positions in the first number of time slot blocks and record them as subscript vectors to be shared with the watermark detection end, where the second number is equal to the redundancy of the watermark to be embedded;

[0008] Generate a pseudo-random seed based on the current timestamp and the random salt value through a hash function, input the pseudo-random seed into a pseudo-random generator to generate a pseudo-random number sequence element value with a length equal to the number of bits, and then map it into a watermark signal in the form of a binary array; perform redundant encoding on the watermark signal according to the redundancy of the watermark to be embedded and the subscript vector to obtain a watermark error correction code; and perform an exclusive OR operation on the watermark error correction code and the basic watermark bit to obtain a real embedded watermark signal;

[0009] The time slots in each time slot block are distinguished into an even time slot group and an odd time slot group, and the expected value of the centroid difference of the odd and even time slot groups is distinguished by adding a time delay to the even time slot group or the odd time slot group, so as to embed the real embedded watermark signal into the embedded time slot part of each time slot block of the data stream according to the subscript vector, so as to be detected and checked at the watermark detection end.

[0010] In some embodiments, the number of the basic time slots is only 2, and the number of the embedded time slots is an even number;

[0011] The method determines the basic watermark bit according to the transmission rate of the flow in the basic time slot, and the calculation formula is:

[0012] ;

[0013] in, Indicates the first basic time slot, Indicates the second basic time slot, represents the streaming rate in the first basic time slot, represents the streaming rate in the second basic time slot, Represents the basic watermark bit;

[0014] The calculation formula for the flow transmission rate is:

[0015] ;

[0016] Among them, I i represents the i-th time slot, L ij represents the length of the jth packet in the i-th time slot, k i represents the number of packets in the i-th time slot.

[0017] In some embodiments, a pseudo-random seed is generated based on the current timestamp and a random salt value through a hash function, and the calculation formula is:

[0018] ;

[0019] Among them, SHA-1 indicates the use of the SHA-1 hash function, || indicates the concatenation operation, Represents the current timestamp, s represents the random salt value;

[0020] Input the pseudo-random number generator to generate a pseudo-random number sequence element value with a length equal to the number of bits, and the calculation formula is:

[0021] ;

[0022] Wherein, R represents the element value of the pseudo-random number sequence, and its value range is (0,1); PRNG represents the random number generation algorithm; and length represents the length of the generated random number.

[0023] The watermark signal mapped into a binary array is expressed as:

[0024] ;

[0025] in, represents the i-th bit of the watermark signal, represents the value of the i-th element of the pseudo-random number sequence;

[0026] The watermark error correction code and the basic watermark bit are subjected to an XOR operation to obtain the real embedded watermark signal, which is expressed as:

[0027] ;

[0028] in, represents the i-th bit of the real embedded watermark signal, represents the i-th bit of the watermark error correction code, Indicates the i-th bit of the basic watermark bit.

[0029] In some embodiments, the time slots in each time slot block are distinguished into an even time slot group and an odd time slot group, and the expected value of the centroid difference of the odd and even time slot groups is adjusted by adding a time delay to the even time slot group or the odd time slot group to distinguish binary values, so as to embed the true embedded watermark signal into the embedded time slot portion of each time slot block of the data stream according to the subscript vector, comprising:

[0030] Define the aggregate centroid of the even time slot group in a single time slot block as , the aggregation centroid of the odd time slot group is , the calculation formula is:

[0031] ;

[0032] ;

[0033] in, represents the number of packets of the jth time slot in the even time slot group, represents the time slot centroid of the jth time slot in the even time slot group, represents the number of data packets in the jth time slot in the odd time slot group, represents the time slot centroid of the jth time slot in the odd time slot group, represents the number of time slots in the even time slot group or the odd time slot group;

[0034] The calculation formula of the centroid difference of the odd and even time slot groups is:

[0035] ;

[0036] Then the expected value of the centroid difference of the odd and even time slot groups is:

[0037] ;

[0038] For time slot blocks , if the embedded real watermark signal If it is 1, the even time slot group aggregation centroid is added The value of Is a positive value; On the contrary, if the embedded real watermark signal is 0, by increasing The value of is a negative value; Time slot The jth data packet in the interval has an offset relative to the start timestamp of the time slot: exist The interval is evenly distributed, adding delay to the data packet , the calculation formula is:

[0039] ;

[0040] The value range of parameter a is .

[0041] On the other hand, the present invention provides a watermark detection method for Tor network flow, which is executed at a watermark detection end and is used to detect a watermark embedded by the watermark embedding method for Tor network flow. The method comprises the following steps:

[0042] After receiving the data stream, wait for a second set time offset to perform the next operation;

[0043] After performing time synchronization, the data stream is divided into a first number of time slot blocks, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; each time slot block is divided into a plurality of time slots according to the first time length, the first two time slots in each time slot block are used as basic time slots, and the remaining time slots are used as embedding time slots;

[0044] For each time slot block, the transmission flow rate of the basic time slot is calculated and the corresponding basic watermark bit is determined; the embedded time slot is divided into an even time slot group and an odd time slot group, and the expected value of the centroid difference between the odd and even time slot groups is calculated. If it is greater than 0, the corresponding true watermark bit is restored to 1; if it is less than 0, the corresponding true watermark bit is restored to 0; the corresponding watermark error correction code bit is solved based on the basic watermark bit and the true watermark bit. The operation is repeated for each time slot block to obtain a complete watermark error correction code;

[0045] An original watermark signal is extracted from the watermark error correction code based on the shared subscript vector.

[0046] In some embodiments, the method further includes comparing the original watermark signal extracted at the current time step with that extracted at the previous time step to calculate the Hamming distance, and determining that they are of the same source if the Hamming distance is lower than a set value, otherwise they are of different sources.

[0047] In some embodiments, the original watermark signal is extracted from the watermark error correction code based on the shared subscript vector, and the calculation formula is as follows:

[0048] ;

[0049] in, represents the extracted original watermark signal, r represents the watermark redundancy, represents the subscript vector of the i-th bit of the original watermark signal, represents the watermark error correction code of the kth bit.

[0050] On the other hand, the present invention also provides a watermark embedding and detection device for Tor network flow, including a processor, a memory and a computer program / instruction stored in the memory, wherein the processor is used to execute the computer program / instruction, and when the computer program / instruction is executed, the device implements the steps of the above method.

[0051] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above method when executed by a processor.

[0052] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0053] The beneficial effects of the present invention are at least:

[0054] The present invention discloses a watermark embedding method, detection method, and device for Tor network streams. The watermark embedding end divides the data stream into time slot blocks according to the product of the redundancy of the watermark to be embedded and the number of bits. The first two of each time slot block are used as basic time slots to generate dynamic basic watermark bits, and the remaining are used as embedded time slots to add watermarks. A watermark signal is constructed based on redundant coding and basic watermark bits. The embedded time slot portion of each time slot block is distinguished by adding a delay to the even time slot group or the odd time slot group to adjust the expected value of the centroid difference of the odd and even time slot groups to embed a watermark bit. After the time slot blocks are divided, the watermark detection end distinguishes between the basic time slot and the embedded time slot. The true embedded watermark bit is detected by calculating the expected value of the centroid difference of the odd and even time slot groups within the embedded time slot. The watermark error correction code bits are restored to obtain a complete watermark error correction code, and the original watermark signal is extracted based on a shared subscript vector. The present invention uses the basic time slot rate to generate a dynamic watermark reference, and realizes deep coupling of the watermark signal and the original traffic through the XOR operation with the error correction code, which greatly reduces the interference with the statistical characteristics of the network flow and adapts to complex network environments.

[0055] Furthermore, the watermark detection end significantly improves the accuracy of watermark extraction in complex network environments by counting the expected value sign of the centroid difference instead of the absolute delay value.

[0056] Furthermore, a distributed embedding strategy based on a shared subscript vector enhances the security of the watermarking system. By randomly distributing the watermark bits across multiple time slots and using a dynamically generated pseudo-random sequence to determine the embedding location, it is difficult for attackers to locate the watermark features through local traffic analysis. A dynamic seed generated by combining a timestamp and a random salt value ensures that each embedded watermark pattern is unique and irreproducible, effectively preventing replay attacks.

[0057] Furthermore, the proposed method is applicable to highly anonymous scenarios such as the Tor network, achieving low visibility and high reliability of watermark embedding without compromising traffic statistics. Through the synergy of a multi-level error correction mechanism and a dynamic synchronization strategy, the detection end can accurately recover the original watermark signal by sharing only a small amount of information, such as the subscript vector, providing an effective technical means for tracing anonymous network flows.

[0058] Additional advantages, objects, and features of the present invention will be set forth in part in the following description and will become apparent to those skilled in the art upon examination of the following or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained by the structures particularly pointed out in the description and drawings.

[0059] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present invention are not limited to the above specific descriptions, and the above and other purposes that can be achieved by the present invention will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. In the drawings:

[0061] Figure 1 The figure is a flow chart of embedding a detection watermark in a Tor network data stream according to an embodiment of the present invention.

[0062] Figure 2 Schematic diagram of a time slot division method for Tor network data flow according to an embodiment of the present invention.

[0063] Figure 3 A schematic diagram of the structure of time slot blocks for dividing Tor network data streams according to an embodiment of the present invention.

[0064] Figure 4 This is a structural diagram of embedding watermarks in Tor network data streams according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0066] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, the accompanying drawings only show structures and / or processing steps closely related to the solutions according to the present invention, while other details that are not closely related to the present invention are omitted.

[0067] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0068] To address the limitations of determining the homology of network traffic within the Tor anonymous communication network, this paper draws on the concept of "digital watermarking" to covertly embed special watermark information into network traffic by actively modulating certain characteristics of the traffic upstream. After transmission, downstream analysis of captured traffic can determine whether a communication relationship exists between a suspicious sender and receiver. However, the extensive fragmentation, reassembly, and dummy packet mechanisms within the Tor network pose challenges to the robustness of network stream watermarking technology. Furthermore, the delay introduced by stream watermarking technology must not affect the normal user experience, and the algorithm must possess a certain degree of complexity, which also poses challenges to the concealment of network stream watermarking technology.

[0069] The present invention provides a watermark embedding method for Tor network flow, which is used to be executed at the watermark embedding end of the Tor network, referring to Figure 1 The method includes the following steps S101 to S104:

[0070] Step S101: Refer to Figure 2 and Figure 3 The data stream to be processed is divided into a first number of time slot blocks after a first set time offset, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; each time slot block is divided into multiple time slots according to the first time length, the first two time slots in each time slot block are used as basic time slots, and the remaining time slots are used as embedding time slots; the basic watermark bit is determined according to the transmission rate of the stream in the basic time slot.

[0071] Step S102: for each bit in the watermark signal, randomly select a second number of embedding positions in the first number of time slot blocks and record them as subscript vectors to be shared with the watermark detection end. The second number is equal to the redundancy of the watermark to be embedded.

[0072] Step S103: Generate a pseudo-random seed according to the current timestamp and the random salt value through a hash function, input the pseudo-random seed into the pseudo-random generator to generate a pseudo-random number sequence element value with a length equal to the number of bits, and then map it into a watermark signal in the form of a binary array; redundantly encode the watermark signal according to the redundancy of the watermark to be embedded and the subscript vector to obtain a watermark error correction code; perform an XOR operation on the watermark error correction code and the basic watermark bit to obtain the real embedded watermark signal.

[0073] Step S104: Refer to Figure 4 , the time slots in each time slot block are distinguished into even time slot groups and odd time slot groups, and the expected value of the centroid difference of the odd and even time slot groups is adjusted by adding a time delay to the even time slot group or the odd time slot group to distinguish the binary value, so as to embed the real embedded watermark signal into the embedded time slot part of each time slot block of the data stream according to the subscript vector, so as to be detected and checked at the watermark detection end.

[0074] In step S101, the data stream in the Tor network is divided into time slot blocks for watermark embedding. An offset is selected in the data stream, and the data stream is divided into 10n time slots of length T after this offset, where n = r × l, where r is the redundancy of the watermark to be embedded and l is the number of bits. Every 10 time slots constitute a time slot block, with the first two serving as base slots and the last eight serving as embedding slots. In subsequent processing, each time slot block is used to embed one bit of the actual watermark information. To enhance security, a base slot is introduced to construct a dynamic base watermark bit.

[0075] In some embodiments, only two basic time slots are set, and the number of embedded time slots is an even number.

[0076] The method determines the basic watermark bit according to the transmission rate of the flow in the basic time slot, and the calculation formula is:

[0077] ;

[0078] in, Indicates the first basic time slot, Indicates the second basic time slot, Indicates the streaming rate within the first basic time slot, Indicates the streaming rate in the second basic time slot, Represents the basic watermark bit.

[0079] The calculation formula for the flow transmission rate is:

[0080] ;

[0081] Among them, I i represents the i-th time slot, L ij represents the length of the jth packet in the i-th time slot, k i represents the number of packets in the i-th time slot.

[0082] For the divided data stream, the 8 embedded time slots in each time slot block are divided into even time slot group and odd time slot group. There are 10n time slots in each time slot block. Data packets ,use Indicates data packet The absolute timestamp of Represents the absolute timestamp of the starting point of the first time slot block, then For data packets The relative offset from the start of the first time slot block, For data packets Now the relative offset of the time slot interval to which it belongs.

[0083] Given a stream containing enough packets, an arbitrary offset and any interval size , the relative offset of the data packet within its respective time slot interval obey is uniformly distributed, so The expected value of is as follows:

[0084] ;

[0085] Set time slot shared within Data packets , the focus is on time slots The "center of mass" of The offset of the jth data packet relative to the start timestamp of its interval is , then the centroid of the time slot can be obtained , as shown below:

[0086] ;

[0087] If the time slot If there is no data packet in the time slot, the time slot is an empty time slot, and the centroid of the empty time slot is defined as .

[0088] In step S102, after the redundant coding operation, the final real embedded watermark signal contains r×l bits. That is, each l bit of the watermark signal is repeated r times. For each of the n time slot blocks divided in step S101, one bit is embedded in each. Therefore, for each bit in the watermark signal, r bits are selected from the corresponding positions of the n time slot blocks, and the subscript vector is obtained as .

[0089] In step S103, a pseudo-random seed is generated according to the current timestamp and the random salt value through a hash function, and the calculation formula is:

[0090] ;

[0091] Among them, SHA-1 indicates the use of the SHA-1 hash function, || indicates the concatenation operation, Represents the current timestamp, and s represents a random salt value.

[0092] Input the pseudo-random seed into the pseudo-random generator to generate a pseudo-random number sequence element value with a length equal to the number of bits. The calculation formula is:

[0093] ;

[0094] Where R represents the element value of the pseudo-random number sequence, with a value range of (0,1), PRNG represents the random number generation algorithm, and length is the length of the generated random number.

[0095] The element value of the pseudo-random number sequence is mapped to a watermark signal in the form of a binary array. The expression is:

[0096] ;

[0097] in, represents the i-th bit of the watermark signal, Represents the value of the i-th element of a pseudo-random number sequence.

[0098] The watermark signal generates a watermark error correction code based on the redundancy of the watermark to be embedded and the subscript vector.

[0099] The watermark error correction code and the basic watermark bit are subjected to an XOR operation to obtain the real embedded watermark signal, which is expressed as:

[0100] ;

[0101] in, Indicates the i-th bit of the real embedded watermark signal, represents the i-th bit of the watermark error correction code, Indicates the i-th bit of the basic watermark bit.

[0102] In step S104, the embedded time slots in the time slot block can be marked as , distinguish even time slot groups

[0103] and odd time slot group , the expression is as follows:

[0104] ;

[0105] ;

[0106] Define the aggregate centroid of the even time slot group in a single time slot block as , the aggregation centroid of the odd time slot group is , the calculation formula is:

[0107] ;

[0108] ;

[0109] in, represents the number of packets in the jth time slot in the even time slot group, represents the time slot centroid of the jth time slot in the even time slot group, represents the number of data packets in the jth time slot in the odd time slot group, represents the time slot centroid of the jth time slot in the odd time slot group, Indicates the number of time slots in the even time slot group or the odd time slot group.

[0110] The expected values ​​of the aggregate centroids of the even and odd time slot groups are as follows:

[0111] ;

[0112] The calculation formula for the centroid difference of odd and even time slot groups is:

[0113] ;

[0114] Then the expected value of the centroid difference between the odd and even time slot groups is:

[0115] ;

[0116] For time slot blocks , if the embedded real watermark signal If it is 1, the even time slot group aggregation centroid is added The value of Is a positive value; on the contrary, if the embedded real watermark signal is 0, by increasing The value of is a negative value; Time slot The jth data packet in the interval has an offset relative to the start timestamp of the time slot: exist The interval is evenly distributed, adding delay to the data packet , the calculation formula is:

[0117] ;

[0118] The value range of parameter a is .

[0119] On the other hand, the present invention provides a watermark detection method for Tor network flow, which is executed at a watermark detection end and is used to detect the watermark embedded by the watermark embedding method for Tor network flow in steps S101 to S104. Figure 1 , the method includes the following steps S201 to S204:

[0120] Step S201: After receiving the data stream, wait for a second set time offset to execute the next step.

[0121] Step S202: After time synchronization is performed, the data stream is divided into a first number of time slot blocks, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; each time slot block is divided into multiple time slots according to the first time length, the first two time slots in each time slot block are used as basic time slots, and the remaining time slots are used as embedded time slots.

[0122] Step S203: For each time slot block, calculate the transmission flow rate of the basic time slot and determine the corresponding basic watermark bit; divide the embedded time slot into even time slot groups and odd time slot groups, and calculate the expected value of the centroid difference between the odd and even time slot groups. If it is greater than 0, restore the corresponding true watermark bit to 1; if it is less than 0, restore the corresponding true watermark bit to 0; solve the corresponding watermark error correction code bit according to the basic watermark bit and the true watermark bit, repeat the operation for each time slot block to obtain a complete watermark error correction code.

[0123] Step S204: extracting the original watermark signal from the watermark error correction code based on the shared subscript vector.

[0124] In step S201, after receiving the data stream, the watermark detection end first performs synchronization and waits for a second set time offset, where the second set time offset is the sum of the first set time offset and the transmission delay.

[0125] In step S202, the time slot blocks and time slots are divided using the same rules, time slot length, watermark error correction code bit data n and other parameters as those of the watermark embedding segment, and the basic time slots and embedded time slots are divided at the same time.

[0126] In step S203, the watermark error correction code is extracted from the stream. For each time slot block , first calculate the flow transmission rate of the basic time slot in the time slot block and , calculate the aggregate centroid of the even time slot group and the odd time slot group within the time slot block and Subtract . Then by and Restore the basic watermark bits within the time slot block ,if , then restore the real watermark position is '1', otherwise it is restored to '0'. Calculated basic watermark bit and the real watermark bit , calculate the watermark error correction code bits Repeat the above steps to finally get the detection watermark error correction code .

[0127] In some embodiments, the original watermark signal is extracted from the watermark error correction code based on the shared subscript vector, and the calculation formula is as follows:

[0128] ;

[0129] in, represents the extracted original watermark signal, r represents the watermark redundancy, Represents the subscript vector of the i-th bit of the original watermark signal, represents the watermark error correction code of the kth bit.

[0130] In some embodiments, the method further includes comparing the original watermark signal extracted at the current time step with that extracted at the previous time step to calculate the Hamming distance, and determining that they are of the same source if the Hamming distance is lower than a set value, otherwise they are of different sources.

[0131] On the other hand, the present invention also provides a watermark embedding and detection device for Tor network flow, including a processor, a memory and a computer program / instruction stored in the memory, wherein the processor is used to execute the computer program / instruction, and when the computer program / instruction is executed, the device implements the steps of the above method.

[0132] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above method when executed by a processor.

[0133] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0134] The present invention will be described below in conjunction with a specific embodiment:

[0135] This embodiment proposes a Tor network stream watermark generation method, device, and storage medium, aiming to overcome the challenges faced by existing background technologies. Through the steps of time slot block division, original watermark signal generation and redundant encoding, watermark embedding, watermark detection, and homology determination, the communication relationship between suspicious senders and receivers is accurately determined. This method is particularly suitable for scenarios such as active network tracking and covert channels. The technical method is as follows:

[0136] Step S1: Time slot block division. For packets sent by the transmitter, a data packet flow with a certain duration through a complex network is considered the target traffic. Time slot intervals are divided starting from an offset, with each time slot interval as the unit. Based on this, a fixed number of time slot intervals are combined to form a time slot block.

[0137] Step S2: Watermark signal generation and redundant encoding. A pseudo-random seed is generated using the timestamp information and a random salt value. Based on the pseudo-random seed, a pseudo-random number generator is used to generate a random number sequence and map it to a 0-1 watermark original signal. After obtaining the original watermark signal, redundant encoding is performed to generate a watermark error correction code.

[0138] Step S3: Watermark embedding. For each bit of the watermark error correction code, a corresponding time slot block is used for watermark embedding. The actual embedded watermark bit is obtained based on the relationship between the basic time slot flow rate within the time slot block and the watermark error correction code. By adjusting the difference between the aggregate centroids of the even and odd time slot groups within the time slot block embedding time slot, the 0-1 watermark bits are dynamically embedded into the corresponding time slot block in combination with the flow rate characteristics, ensuring the complexity and concealment of the watermark algorithm.

[0139] Step S4: Watermark detection. After receiving the data stream, the watermark detection end must first complete time synchronization with the watermark detection end. After time synchronization is completed, the watermark error correction code is restored according to the time slot blocks divided in step S1, and the original watermark signal is extracted according to the redundancy rule in step S2.

[0140] Step S5: Homogeneity determination: The traffic homology is determined based on the original watermark signal generated in step S2 and the original watermark signal extracted in step S4. The difference between the two is calculated, and a threshold is set. If the difference is less than the threshold, the traffic is determined to have the same source, that is, the communication relationship between the suspicious sender and the legitimate receiver.

[0141] At the same time, this embodiment provides a device for a Tor network stream watermark embedding detection method, which is used to implement the above method and includes the following modules:

[0142] Time block division module: configured to divide the network data packet stream sent by the sender into time slot blocks, and generate a time slot block sequence including basic time slots and embedded time slots according to the preset offset duration and redundancy.

[0143] Watermark signal generation and redundant coding module: It includes a pseudo-random seed generation unit, which generates a pseudo-random seed through a hash function based on the timestamp and random salt value; a built-in pseudo-random number generator, which maps the pseudo-random number to the original watermark signal, and uses the redundant coding rules to generate the watermark error correction code.

[0144] Watermark embedding module: Dynamically calculates the flow rate of the basic time slot within the time slot block to generate the basic watermark bit, and combines it with the watermark error correction code to generate the real embedded watermark bit; based on the real watermark bit, adjusts the difference in the aggregation center of mass between the even time slot group and the odd time slot group within the time slot block through the delay strategy to achieve dynamic watermark embedding.

[0145] Watermark detection module: includes a time synchronization unit for calibrating the time offset between the watermark detection end and the embedding end to offset the impact of Tor network transmission delay; a time slot block division unit is configured to divide the received traffic into time slot blocks based on the same parameters; a built-in centroid calculation unit and a basic time slot flow rate calculation unit are built to restore the original watermark signal by aggregating the centroid difference and flow rate.

[0146] Homologousness determination module: Calculates the Hamming distance between the original watermark signal and the detected watermark signal, and compares it with the preset threshold to determine whether the traffic is of the same source; supports dynamic adjustment of the threshold to adapt to the false alarm rate and false negative rate requirements in different network environments.

[0147] The specific implementation is as follows:

[0148] like Figure 1The figure shows a framework diagram of a dynamic adaptive stream watermarking method based on stream rate and time slot centroid characteristics. The specific steps are as follows:

[0149] Step S11: Time slot block division. For the sender, the duration of the time it takes to pass through the Tor network is The data packet stream f, the redundancy of the watermark to be embedded is , the number of bits is First, in the data flow Select the offset To start, select a duration ,Will Divided into (in ) length is The time slot interval: On this basis, 10 time slots are combined into a time slot block unit. , It can be viewed as consisting of n time slot blocks of length 10T: ,like Figure 2 shown.

[0150] A time slot block It contains 10 time slots of length T, as shown in the following formula:

[0151] ;

[0152] For timing blocks , the 10 time slots are divided into basic time slots With embedded time slots The base time slot consists of the first 2 time slots, and the embedded time slot consists of the last 8 time slots, as shown in the following formula.

[0153] ;

[0154] Assume that the length is The continuous data flow of each time slot block has 10n time slots. Data packets ,use Indicates data packet The absolute timestamp of Represents the absolute timestamp of the starting point of the first time slot block, then For data packets The relative offset from the start of the first time slot block, For data packets Now the relative offset of the time slot interval to which it belongs.

[0155] Given a stream containing enough packets, an arbitrary offset and any interval size , the relative offset of the data packet within its respective time slot interval obey is uniformly distributed, so The expected value of is as follows:

[0156] ;

[0157] Set time slot shared within Data packets , the focus is on time slots The "center of mass" of The offset of the jth data packet relative to the start timestamp of its interval is , then the centroid of the time slot can be obtained , as shown below:

[0158] ;

[0159] If the time slot If there is no data packet in the time slot, the time slot is an empty time slot, and the centroid of the empty time slot is defined as .

[0160] The stream watermarking scheme of this method, the timing block The structural diagram of Figure 3 As shown in Figure 1. Each time slot block consists of a base time slot and a marker time slot, which are responsible for embedding one bit of watermark information. The base time slot contains two sub-time slots, which determine the actual watermark bit to be embedded by comparing the flow rate relationship between the two time slots and combining them with the original watermark bit. The marker time slot contains four time slots, which are mainly used to derive the actual watermark based on the base time slot and modulate the network traffic of the marker time slot. NTNW completes watermark information embedding through the interaction of the base time slot and the marker time slot in the time slot block.

[0161] Step S12: watermark signal generation and redundant encoding. For the sender, the duration of the signal passing through the Tor network is The data packet stream f, the redundancy of the watermark signal W to be embedded is r, and the number of watermark bits is l. The generation of consists of three steps: pseudo-random seed generation, original watermark signal generation and redundant encoding, and the number of bits is n.

[0162] First, use the current timestamp Generate a pseudo-random seed with a random salt value s , as shown below:

[0163] ;

[0164] Among them, SHA-1 indicates the use of SHA-1 hash function, and || indicates the concatenation operation, which concatenates the current timestamp and the random salt value in string form. Then, according to the pseudo-random seed , use a pseudo-random number generator to generate a pseudo-random number sequence R of length l, where the random number value range in R is (0,1), as shown in the following formula:

[0165] ;

[0166] According to the pseudo-random number sequence R, the watermark signal W is generated by mapping the element values ​​of the pseudo-random number sequence, as shown in the following formula:

[0167] ;

[0168] in, represents the i-th bit of the watermark signal, Represents the value of the ith element of the pseudo-random number sequence. The watermark signal W consists of multiple bits represented by '0' and '1', and can be expressed as a binary array of length l as follows.

[0169] ;

[0170] After obtaining the watermark signal W, the next step is to generate a watermark error correction code through redundant coding. In order to enhance the robustness of the watermark signal and resist the damage of network jitter and other interference to part of the watermark signal, redundant coding is introduced. When the redundancy is r, each bit of the watermark signal W will be transmitted r times to improve the reliability of the watermark signal. The length of the watermark error correction code is , for each bit of the watermark signal Randomly select r positions from n positions, and the subscript vector is , fill in the positions of these subscripts with , and finally generate the watermark error correction code , and the subscript vector corresponding to each bit of the watermark signal , as a shared parameter between the watermark embedding end and the watermark detection end.

[0171] Step S13: Watermark embedding. Assume time slot shared within Data packets , the corresponding data packet length is , the flow transmission rate of this time slot is , the calculation formula is as follows:

[0172] ;

[0173] If the time slot If there is no data packet transmission in the time slot, the flow transmission rate of the time slot is recorded as 0.

[0174] For each bit of the watermark error correction code , each has a corresponding time slot block Used to embed the watermark, where First, use the base time slot of the time slot block to calculate its two sub-time slots , Streaming rate and , according to the size relationship, the basic watermark bit of the time slot block is obtained , used for watermark error correction code Used together, as shown below:

[0175] ;

[0176] In order to enhance the concealment of watermark embedding, according to the time slot block Corresponding watermark error correction code With the basic watermark , the real embedded watermark signal is obtained through XOR operation , as shown below:

[0177] ;

[0178] Block per time slot The last 8 time slots are marker time slots , distinguish even time slot groups and odd time slot group , the expression is as follows:

[0179] ;

[0180] ;

[0181] Define the aggregate centroid of the even time slot group in a single time slot block as , the aggregation centroid of the odd time slot group is , is calculated from the time slot centroid and the number of packets in the time slot, as shown below:

[0182] ;

[0183] ;

[0184] in, represents the number of packets in the jth time slot in the even time slot group, represents the time slot centroid of the jth time slot in the even time slot group, represents the number of data packets in the jth time slot in the odd time slot group, represents the time slot centroid of the jth time slot in the odd time slot group, Indicates the number of time slots in the even time slot group or the odd time slot group.

[0185] The expected value of the aggregate centroid of the even time slot group and the odd time slot group is calculated as follows:

[0186] ;

[0187] The calculation formula for the centroid difference of odd and even time slot groups is:

[0188] ;

[0189] Then the expected value of the centroid difference between the odd and even time slot groups is:

[0190] ;

[0191] For time slot blocks , if the embedded real watermark signal If it is 1, the even time slot group aggregation centroid is added The value of Is a positive value; on the contrary, if the embedded real watermark signal is 0, by increasing The value of is a negative value; Time slot The jth data packet in the interval has an offset relative to the start timestamp of the time slot: exist The interval is evenly distributed, adding delay to the data packet , the calculation formula is:

[0192] ;

[0193] The value range of parameter a is , the new offset of the packet after adding the delay Will be in The delay strategy will be evenly distributed in the interval. The relative offset of the interval is compressed to The expected values ​​of the even time slot group aggregate centroid and the odd time slot group aggregate centroid obtained by using the above delay strategy are shown as follows:

[0194] ;

[0195] set up To increase the result after the centroid of the even time slot group is embedded with the watermark bit "1", To increase the result after the centroid of the odd time slot group is embedded with the watermark bit "0", its expected value is shown in the following formula:

[0196] ;

[0197] In summary, the real watermark The embedding of "1" or "0" will make the time slot block Deviated to the right or , the implementation is as follows Figure 4 shown.

[0198] Step S14: Watermark detection. After the watermark information is embedded, the target network flow f is forwarded through the Tor network and reaches the exit relay node where the watermark detection module is deployed. The watermark detection party is responsible for monitoring the target network flow sent to the suspicious receiving end. The following describes the specific process of watermark information detection:

[0199] Watermark embedding and detection synchronization: After the watermark detection end receives the data stream, it needs to wait for the time offset , which is the time offset required for synchronization between the watermark detection module and the watermark embedding module. ,in , It represents the sum of the transmission delay and time disturbance required from the watermark embedding end to the watermark detection end through the Tor network, which is an empirical coefficient. Then proceed to the next step.

[0200] Watermark error correction code restoration: After the watermark detection end completes time synchronization, the data stream Start segmenting the time slot block. Use the same time slot interval length T as the watermark embedding end, the number of watermark error correction code bits n and other parameters to capture the data stream Perform time slot block segmentation. Extract the watermark error correction code from the stream. For each time slot block , first calculate the flow transmission rate of the basic time slot in the time slot block and , calculate the aggregate centroid of the even time slot group and the odd time slot group within the time slot block and Subtract . Then by and Restore the basic watermark bits within the time slot block ,if , then restore the real watermark position is '1', otherwise it is restored to '0'. Calculated basic watermark bit and the real watermark bit , calculate the watermark error correction code bits Repeat the above steps to finally get the detection watermark error correction code .

[0201] Extraction of original watermark signal: Detection to obtain watermark error correction code Then, according to the redundancy rule when embedding the watermark, the original watermark signal bit is located in the mapping subscript vector of the watermark error correction code subscript Extract the original watermark signal. Let the jth subscript vector , analyze the watermark error correction code restored at the position of the r subscripts of the subscript vector, and restore the original watermark signal of the i-th position , the calculation formula is shown below. Finally, the original detection watermark signal is extracted from the watermark detection error correction code .

[0202] Step S5: Homology determination. After the above steps, the original watermark information is finally and the original detection watermark signal extracted in the previous step Determine the homology of traffic. Calculate and The difference between them is measured using the Hamming distance and is recorded as , set the threshold ,according to Is it lower than , determine whether the traffic has the same source and confirm the communication relationship between the receiver and the sender.

[0203] ;

[0204] Corresponding to the above method, the present invention also provides an apparatus / system, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the apparatus / system implements the steps of the method described above.

[0205] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0206] In summary, the watermark embedding method, detection method, and device for Tor network streams described in the present invention divide the data stream into time slot blocks according to the product of the redundancy of the watermark to be embedded and the number of bits. The first two of each time slot block are used as basic time slots to generate dynamic basic watermark bits, and the rest are used as embedded time slots to add watermarks. A watermark signal is constructed based on redundant coding and basic watermark bits. The embedded time slot portion of each time slot block is distinguished by adding a delay to the even time slot group or the odd time slot group to adjust the expected value of the centroid difference of the odd and even time slot groups to embed a watermark bit. After the time slot blocks are divided at the watermark detection end, the basic time slot and the embedded time slot are distinguished. The real embedded watermark bit is detected by calculating the expected value of the centroid difference of the odd and even time slot groups in the embedded time slot, the watermark error correction code bits are restored, and the complete watermark error correction code is obtained. The original watermark signal is extracted based on the shared subscript vector. The present invention uses the basic time slot rate to generate a dynamic watermark reference, and realizes deep coupling of the watermark signal and the original traffic through the XOR operation with the error correction code, which greatly reduces the interference with the statistical characteristics of the network flow and adapts to complex network environments.

[0207] Furthermore, the watermark detection end significantly improves the accuracy of watermark extraction in complex network environments by counting the expected value sign of the centroid difference instead of the absolute delay value.

[0208] Furthermore, a distributed embedding strategy based on a shared subscript vector enhances the security of the watermarking system. By randomly distributing the watermark bits across multiple time slots and using a dynamically generated pseudo-random sequence to determine the embedding location, it is difficult for attackers to locate the watermark features through local traffic analysis. A dynamic seed generated by combining a timestamp and a random salt value ensures that each embedded watermark pattern is unique and irreproducible, effectively preventing replay attacks.

[0209] Furthermore, the proposed method is applicable to highly anonymous scenarios such as the Tor network, achieving low visibility and high reliability of watermark embedding without compromising traffic statistics. Through the synergy of a multi-level error correction mechanism and a dynamic synchronization strategy, the detection end can accurately recover the original watermark signal by sharing only a small amount of information, such as the subscript vector, providing an effective technical means for tracing anonymous network flows.

[0210] It should be understood by those skilled in the art that the various exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether to implement the system in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention. When implemented in hardware, it may be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via a data signal carried in a carrier wave.

[0211] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0212] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0213] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A watermark embedding method for Tor network flow, characterized in that: The method is used to be executed at a watermark embedding end of a Tor network, and the method comprises the following steps: Dividing the data stream to be processed into a first number of time slot blocks after a first set time offset, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; dividing each time slot block into a plurality of time slots according to a first time length, with the first two time slots in each time slot block serving as basic time slots and the remaining time slots serving as embedding time slots; and determining a basic watermark bit according to a transmission rate of the stream within the basic time slot; For each bit in the watermark signal, randomly select a second number of embedding positions in the first number of time slot blocks and record them as subscript vectors to be shared with the watermark detection end, where the second number is equal to the redundancy of the watermark to be embedded; Generate a pseudo-random seed using a hash function based on the current timestamp and a random salt value, input the seed into a pseudo-random generator to generate a pseudo-random number sequence element value with a length equal to the number of bits, and then map the pseudo-random seed into the watermark signal in the form of a binary array; perform redundant encoding on the watermark signal according to the redundancy of the watermark to be embedded and the subscript vector to obtain a watermark error correction code; and perform an exclusive-OR operation on the watermark error correction code and the basic watermark bit to obtain a true embedded watermark signal; The time slots in each time slot block are distinguished into an even time slot group and an odd time slot group, and the expected value of the centroid difference of the odd and even time slot groups is distinguished by adding a time delay to the even time slot group or the odd time slot group, so as to embed the real embedded watermark signal into the embedded time slot part of each time slot block of the data stream according to the subscript vector, so as to be detected and checked at the watermark detection end.

2. The watermark embedding method for Tor network flow according to claim 1, characterized in that: There are only two basic time slots, and the number of embedded time slots is an even number; The method determines the basic watermark bit according to the transmission rate of the flow in the basic time slot, and the calculation formula is: ； in, Indicates the first basic time slot, Indicates the second basic time slot, represents the streaming rate in the first basic time slot, represents the streaming rate in the second basic time slot, Represents the basic watermark bit; The calculation formula for the flow transmission rate is: ； Among them, I i represents the i-th time slot, L ij represents the length of the jth packet in the i-th time slot, k i represents the number of packets in the i-th time slot.

3. The watermark embedding method for Tor network flow according to claim 2, characterized in that: Generate a pseudo-random seed based on the current timestamp and random salt value through a hash function. The calculation formula is: ； Among them, SHA-1 indicates the use of the SHA-1 hash function, || indicates the concatenation operation, Represents the current timestamp, s represents the random salt value; Input the pseudo-random number generator to generate a pseudo-random number sequence element value with a length equal to the number of bits, and the calculation formula is: ； Wherein, R represents the element value of the pseudo-random number sequence, and its value range is (0,1); PRNG represents the random number generation algorithm; and length represents the length of the generated random number. The watermark signal mapped into a binary array is expressed as: ； in, represents the i-th bit of the watermark signal, represents the value of the i-th element of the pseudo-random number sequence; The watermark error correction code and the basic watermark bit are subjected to an XOR operation to obtain the real embedded watermark signal, which is expressed as: ； in, represents the i-th bit of the real embedded watermark signal, represents the i-th bit of the watermark error correction code, Indicates the i-th bit of the basic watermark bit.

4. The watermark embedding method for Tor network flow according to claim 3, characterized in that: The method further comprises: distinguishing the time slots in each time slot block from an even time slot group and an odd time slot group, and adjusting the expected value of the centroid difference of the even and odd time slot groups by adding a time delay to the even time slot group or the odd time slot group to distinguish binary values, so as to embed the true embedded watermark signal into the embedded time slot portion of each time slot block of the data stream according to the subscript vector, comprising: Define the aggregate centroid of the even time slot group in a single time slot block as , the aggregation centroid of the odd time slot group is , the calculation formula is: ； ； in, represents the number of packets of the jth time slot in the even time slot group, represents the time slot centroid of the jth time slot in the even time slot group, represents the number of data packets in the jth time slot in the odd time slot group, represents the time slot centroid of the jth time slot in the odd time slot group, represents the number of time slots in the even time slot group or the odd time slot group; The calculation formula of the centroid difference of the odd and even time slot groups is: ； Then the expected value of the centroid difference of the odd and even time slot groups is: ； For time slot blocks , if the embedded real watermark signal If it is 1, the even time slot group aggregation centroid is added The value of Is a positive value; On the contrary, if the embedded real watermark signal is 0, by increasing The value of is a negative value; Time slot The jth data packet in the interval has an offset relative to the start timestamp of the time slot: exist The interval is evenly distributed, adding delay to the data packet , the calculation formula is: ； The value range of parameter a is .

5. A watermark detection method for Tor network flow, characterized in that: The method is executed at a watermark detection end and is used to detect a watermark embedded by the watermark embedding method for Tor network flow according to any one of claims 1 to 4. The method comprises the following steps: After receiving the data stream, wait for a second set time offset to perform the next operation; After performing time synchronization, the data stream is divided into a first number of time slot blocks, where the first number is the product of the redundancy of the watermark to be embedded and the number of bits; each time slot block is divided into a plurality of time slots according to the first time length, the first two time slots in each time slot block are used as basic time slots, and the remaining time slots are used as embedding time slots; For each time slot block, the transmission flow rate of the basic time slot is calculated and the corresponding basic watermark bit is determined; the embedded time slot is divided into an even time slot group and an odd time slot group, and the expected value of the centroid difference between the odd and even time slot groups is calculated. If it is greater than 0, the corresponding true watermark bit is restored to 1; if it is less than 0, the corresponding true watermark bit is restored to 0; the corresponding watermark error correction code bit is solved based on the basic watermark bit and the true watermark bit. The operation is repeated for each time slot block to obtain a complete watermark error correction code; An original watermark signal is extracted from the watermark error correction code based on the shared subscript vector.

6. The watermark detection method for Tor network flow according to claim 5, characterized in that: The method further includes comparing the original watermark signal extracted at the current time step with the original watermark signal extracted at the previous time step to calculate the Hamming distance, and determining that they are of the same source if the Hamming distance is lower than a set value, otherwise they are of different sources.

7. The watermark detection method for Tor network flow according to claim 6, characterized in that: The original watermark signal is extracted from the watermark error correction code based on the shared subscript vector, and the calculation formula is as follows: ； in, represents the extracted original watermark signal, r represents the watermark redundancy, represents the subscript vector of the i-th bit of the original watermark signal, represents the watermark error correction code of the kth bit.

8. A watermark embedding and detection device for Tor network flows, comprising a processor, a memory, and a computer program / instruction stored in the memory, characterized in that: The processor is configured to execute the computer program / instructions. When the computer program / instructions are executed, the device implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images