应用科学学报 ›› 2013, Vol. 31 ›› Issue (4): 361-367.doi: 10.3969/j.issn.0255-8297.2013.04.005

• 通信工程 • 上一篇    下一篇

Monte Carlo 网络流量伪装

王禹, 王振兴, 苗甫, 刘慧生, 张连成   

  1. 数学工程与先进计算国家重点实验室,郑州450002
  • 收稿日期:2011-09-13 修回日期:2011-12-26 出版日期:2013-07-27 发布日期:2011-12-26
  • 作者简介:王禹,博士生,研究方向:网络流量伪装、网络主动防御等,E-mail: stonchor@gmail.com;王振兴,教授,博导,研究方向:流量分析、网络与信息安全,E-mail: wzx05@sina.com
  • 基金资助:

    国家“973”重点基础研究发展计划基金(No. 2007CB307102);国家“863”高技术研究发展计划基金(No. 2007AA01Z2A1)资助

Monte Carlo-Based Network Traffic Camouflage

WANG Yu, WANG Zhen-xing, MIAO Fu, LIU Hui-sheng, ZHANG Lian-cheng   

  1. Stake Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450002, China
  • Received:2011-09-13 Revised:2011-12-26 Online:2013-07-27 Published:2011-12-26

摘要: 针对流量伪装成本高、伪装相似度低等问题,提出一种基于蒙特卡罗的流量伪装方法. 通过对所处网络环境的常规流量进行统计分析,获取多重动态特征并建立概率分布过程,利用随机数对已知概率分布抽样,产生动态特征序列并构造伪装流量. 理论分析表明,该方法无需部署额外的重路由节点且伪装过程不产生分散数据,可在保证伪装生成效率的前提下降低伪装成本,提高网络性能. 实验表明,该方法可降低流量检测的准确度及可信度,与现有包填充方法相比,伪装相似度也有较大改善.

关键词: 网络安全, 流量伪装, 蒙特卡罗, 伪装能力

Abstract: Heavy camouflage cost and low camouflage similarity are major problems in the traffic camouflage research. Network traffic camouflage based on the Monte Carlo method is proposed to deal with the problems. To acquire multiple dynamic characteristics and establish the probability distribution, the normal traffic is analyzed. The given probability distribution is then sampled with the generated random numbers to determine the dynamic characteristic sequences and construct the camouflage traffic flow. Theoretical analysis indicates that no extra rerouting nodes are deployed and no dispersion traffic generated. The network cost is reduced, the transport performance improved, and the efficiency guaranteed. Experiments show that the method can degrade the detection accuracy and reliability. Compared to the packet padding method, camouflage similarity is well improves.

Key words: network security, traffic camouflage, Monte Carlo, camouflage capability

中图分类号: