ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2021, Vol. 58 ›› Issue (11): 2400-2415.doi: 10.7544/issn1000-1239.2021.20210654

所属专题: 2021密码学与网络空间安全治理专题

• 信息安全 • 上一篇    下一篇

一种面向IPv6网络空间的特征水印生成与嵌入方案研究

陶军1,2,3,朱珍超1,2,3,王昭悦1,李文强1,2,孙炜策1,2   

  1. 1(东南大学网络空间安全学院 南京 211189);2(计算机网络和信息集成教育部重点实验室(东南大学) 南京 211189);3(网络通信与安全紫金山实验室 南京 100084) (wqli@seu.edu.cn)
  • 出版日期: 2021-11-01
  • 基金资助: 
    国家重点研发计划项目(2018YFB1800205);中央高校基本科研业务费专项资金(2242021k30024);阿里云高校数字化创新专项(2021ALA03006);江苏省研究生研究与实践创新计划(KYCX180103)

A Feature Watermarking Generation and Embedding Scheme for IPv6 Network

Tao Jun1,2,3, Zhu Zhenchao1,2,3, Wang Zhaoyue1, Li Wenqiang1,2, Sun Weice1,2   

  1. 1(School of Cyber Science and Engineering, Southeast University, Nanjing 211189);2(Key Laboratory of Computer Network and Information Intergration (Southeast University), Ministry of Education, Nanjing 211189);3(Purple Mountain Laboratories for Network Communication and Security, Nanjing 100084)
  • Online: 2021-11-01
  • Supported by: 
    This work was supported by the National Key Research and Development Program of China (2018YFB1800205), the Fundamental Research Funds for the Central Universities (2242021k30024), Alibaba Cloud College Digital Innovation Project (2021ALA03006), and the Postgraduate Research & Practice Innovation Program of Jiangsu Province (KYCX180103).

摘要: 在有限的时空资源条件下,研究人员使用网络隐蔽通道,基于少量的水印信息来追踪攻击流,定位真实攻击源.然而,水印内容和位置的相对固定会造成追踪的流量呈现出自相似性,并且IPv6协议内嵌的IPsec加密协议限制了载体的选择范围,基于单一载体的水印嵌入方案更容易被识别攻击.因此针对水印隐蔽性的优化目标,结合IPv6报文中间节点不分片的特性,考虑间断性传输网络和流速较慢网络的特征提取限制,设计目标流关联的特征水印序列提取策略,针对不同的网络传输场景,制定了包依赖的基于混合隐蔽通道和时间依赖的基于混合时隙的水印嵌入方式.模拟实验表明:提出的水印生成与嵌入技术,能够在保证一定准确率的前提下,降低水印嵌入对原始流量的影响,减少水印被识别攻击的概率,提高水印的隐蔽性.

关键词: 特征水印, 隐蔽通道, 混合时隙, IPv6协议, 流关联分析

Abstract: Under the limitation of space and time resources, researchers exploit the network covert channel, which based on a small amount of watermark information, to trace the attack flow and locate the real attack source. However, the self-similarity of the tracked traffic would appear because of the relatively fixed content and location of the watermark. What’s more, the IPSec encryption protocol embedded in the IPv6 protocol limits the range of carrier choice, which may threaten the watermarking based on the single carrier. In this paper, Targeting at optimizing the watermark invisibility, combined with intermediate node not dividing the packet for IPv6 environment, considering the feature extraction limitation of intermittent transmission network and slow flow network, the feature watermarking sequence extraction strategy associated with the target stream is designed. Aiming at different network transmission scenarios, a packet-dependent watermarking generation based on mixed covert channel and a time-dependent watermarking generation based on mixed time slot are proposed. Extensive experiments show that the watermarking generation technology proposed in this paper can reduce the impact of watermarking embedding on the original traffic, decrease the probability of watermarking being recognized and attack, and improve the imperceptibility of watermark under the premise of certain accuracy.

Key words: feature watermarking, covert channel, mixed interval, IPv6 protocol, flow correlation analysis

中图分类号: