Online Identification of Tor Anonymous Communication Traffic

Abstract

PDF HTML阅读 XML下载 导出引用 引用提醒 Tor匿名通信流量在线识别方法 DOI: 10.3724/SP.J.1001.2013.04253 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家重点基础研究发展计划(973)(2010CB328104); 国家自然科学基金(61272054, 61202449, 61070161, 61003257,60903162); 国家科技支撑计划(2010BAI88B03, 2011BAK21B02); 国家核高基科技重大专项(软件类)项目(2010ZX01044-001-001);高等学校博士点专项科研基金(20110092130002); 江苏省自然科学基金(BK2008030); 江苏省网络与信息安全重点实验室资助项目(BM2003201); 教育部计算机网络与信息集成重点实验室(东南大学)资助项目(93K-9) Online Identification of Tor Anonymous Communication Traffic Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:匿名通信技术的滥用给网络监管带来了新的挑战.有效识别出匿名通信流量,是阻止该类技术滥用的前提,具有重要的研究意义和应用价值.现有研究工作侧重于匿名通信关系的确认,无法用于匿名通信流量的识别和阻塞.针对这个问题,围绕广泛使用的Tor匿名通信系统,深入分析运行机制,归纳总结其流量特征.在此基础上,分别提出基于TLS指纹和基于报文长度分布的Tor匿名通信流量识别方法.对两种识别方法的优缺点和适用性进行了详细分析和讨论,并通过CAIDA数据集和在线部署对识别方法进行了验证.实验结果表明,基于TLS指纹和基于报文长度分布的识别方法均能有效识别出Tor匿名通信流量. Abstract:Abuse of anonymous communication systems has introduced new challenges into network administration. The effective identification of anonymous communication traffic is a prerequisite to prevent such abuse; thus, this is fundamentally important for both theoretical researches and practical applications. Existing researches mainly focus on the confirmation of anonymous communication relationship and cannot be used to identify and block anonymous communication traffic. To solve this problem, the operation mechanism is deeply analyzed and traffic characteristics are summarized for the widely used Tor anonymous communication system. On this basis, a TLS fingerprint-based and packet-size distributions based methods are proposed to identify Tor anonymous communication traffic, respectively. The advantages, disadvantages and applicability of these two methods are analyzed and discussed in detail, and are validated by CAIDA dataset and online deployment. Experimental results prove that both methods are effective in identifying Tor anonymous communication traffic. 参考文献 相似文献 引证文献