在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络...在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络持续性隐蔽威胁深度检测方法。采用生成对抗网络根据持续性隐蔽威胁攻击特点生成接近真实船用网络的持续性隐蔽威胁攻数据样本。利用长短期记忆网络捕捉船用网络流量中的长期依赖关系,精准识别潜在威胁并输出深度检测结果。实验结果表明,生成样本与真实样本的相似度得分保持在0.9以上,证明了本文方法数据样本生成的质量较高。对于不同船用网络传输距离,攻击链完整度高于70%的阈值,说明本文方法的检测精度较高,能够为船用网络安全防护提供有力的技术支持。展开更多
Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection appr...Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection approaches use either signature-based approaches to detect known TCs or anomaly-based approach by modeling the legitimate network traffic in order to detect unknown TCs. Un-fortunately, in a software-defined networking (SDN) environment, most existing TC detection approaches would fail due to factors such as volatile network traffic, imprecise timekeeping mechanisms, and dynamic network topology. Furthermore, stealthy TCs can be designed to mimic the legitimate traffic pattern and thus evade anomalous TC detection. In this paper, we overcome the above challenges by presenting a novel framework that harnesses the advantages of elastic re-sources in the cloud. In particular, our framework dynamically configures SDN to enable/disable differential analysis against outbound network flows of different virtual machines (VMs). Our framework is tightly coupled with a new metric that first decomposes the timing data of network flows into a number of using the discrete wavelet-based multi-resolution transform (DWMT). It then applies the Kullback-Leibler divergence (KLD) to measure the variance among flow pairs. The appealing feature of our approach is that, compared with the existing anomaly detection approaches, it can detect most existing and some new stealthy TCs without legitimate traffic for modeling, even with the presence of noise and imprecise timekeeping mechanism in an SDN virtual environment. We implement our framework as a prototype system, OBSERVER, which can be dynamically deployed in an SDN environment. Empirical evaluation shows that our approach can efficiently detect TCs with a higher detection rate, lower latency, and negligible performance overhead compared to existing approaches.展开更多
现有存储型网络隐蔽信道的研究主要根据不同协议中不同字段来隐藏信息。在众多协议中,例如TCP、UDP协议,对其研究较多,而OSFP使用广泛却在国内研究较少。针对OSPF协议下的Hello报文进行分析可以构建网络隐蔽信道的字段。从所有可能字段...现有存储型网络隐蔽信道的研究主要根据不同协议中不同字段来隐藏信息。在众多协议中,例如TCP、UDP协议,对其研究较多,而OSFP使用广泛却在国内研究较少。针对OSPF协议下的Hello报文进行分析可以构建网络隐蔽信道的字段。从所有可能字段中选择Authentication、Router Dead Interval和Neighbor三个字段分别使用随机值模式、值调制模型和序列模式进行构建三种隐蔽信道,利用微协议技术优化信道,并将三种隐蔽信道组合成一个传输速率更高的隐蔽信道模型。经过验证,该模型具有一定的可行性和隐蔽性,可为存储型网络隐蔽信道构建技术提供一定的理论支持和技术支撑。展开更多
域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、...域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、误报率高的问题,提出一种融合多通道卷积和注意力网络的DNS隐蔽信道检测算法。该算法基于DNS请求与响应双向流,首先将残差结构和并行卷积相结合,采用不同大小的卷积核提取并融合多尺度特征信息,实现不同感受野特征的捕获;其次引入通道注意力机制增加卷积通道关键信息的提取能力,丰富网络模型的表达能力;最后采用softmax函数实现DNS隐蔽信道的检测。实验结果表明,所提模型能有效检测DNS隐蔽信道,平均准确率、精确率和召回率分别为96.42%、97.82%和96.16%,优于传统方法。展开更多
DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了P...DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了PFEC-Transformer(pcap features extraction CNN-Transformer)模型.该模型以表征后的十进制数值序列作为输入,在经过CNN模块进行局部特征提取后,再通过Transformer分析局部特征间的长距离依赖模式并进行分类.研究采集了互联网流量以及各类DNS隐蔽隧道工具生成的数据包构建数据集,并使用包含未知隧道工具流量的公开数据集进行泛化能力测试.实验结果表明,该模型在测试数据集上取得了高达99.97%的准确率,在泛化测试集上也达到了92.12%的准确率,有效地证明了其在检测未知DNS隐蔽隧道方面的优异性能.展开更多
文摘在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络持续性隐蔽威胁深度检测方法。采用生成对抗网络根据持续性隐蔽威胁攻击特点生成接近真实船用网络的持续性隐蔽威胁攻数据样本。利用长短期记忆网络捕捉船用网络流量中的长期依赖关系,精准识别潜在威胁并输出深度检测结果。实验结果表明,生成样本与真实样本的相似度得分保持在0.9以上,证明了本文方法数据样本生成的质量较高。对于不同船用网络传输距离,攻击链完整度高于70%的阈值,说明本文方法的检测精度较高,能够为船用网络安全防护提供有力的技术支持。
文摘Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection approaches use either signature-based approaches to detect known TCs or anomaly-based approach by modeling the legitimate network traffic in order to detect unknown TCs. Un-fortunately, in a software-defined networking (SDN) environment, most existing TC detection approaches would fail due to factors such as volatile network traffic, imprecise timekeeping mechanisms, and dynamic network topology. Furthermore, stealthy TCs can be designed to mimic the legitimate traffic pattern and thus evade anomalous TC detection. In this paper, we overcome the above challenges by presenting a novel framework that harnesses the advantages of elastic re-sources in the cloud. In particular, our framework dynamically configures SDN to enable/disable differential analysis against outbound network flows of different virtual machines (VMs). Our framework is tightly coupled with a new metric that first decomposes the timing data of network flows into a number of using the discrete wavelet-based multi-resolution transform (DWMT). It then applies the Kullback-Leibler divergence (KLD) to measure the variance among flow pairs. The appealing feature of our approach is that, compared with the existing anomaly detection approaches, it can detect most existing and some new stealthy TCs without legitimate traffic for modeling, even with the presence of noise and imprecise timekeeping mechanism in an SDN virtual environment. We implement our framework as a prototype system, OBSERVER, which can be dynamically deployed in an SDN environment. Empirical evaluation shows that our approach can efficiently detect TCs with a higher detection rate, lower latency, and negligible performance overhead compared to existing approaches.
文摘现有存储型网络隐蔽信道的研究主要根据不同协议中不同字段来隐藏信息。在众多协议中,例如TCP、UDP协议,对其研究较多,而OSFP使用广泛却在国内研究较少。针对OSPF协议下的Hello报文进行分析可以构建网络隐蔽信道的字段。从所有可能字段中选择Authentication、Router Dead Interval和Neighbor三个字段分别使用随机值模式、值调制模型和序列模式进行构建三种隐蔽信道,利用微协议技术优化信道,并将三种隐蔽信道组合成一个传输速率更高的隐蔽信道模型。经过验证,该模型具有一定的可行性和隐蔽性,可为存储型网络隐蔽信道构建技术提供一定的理论支持和技术支撑。
文摘域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、误报率高的问题,提出一种融合多通道卷积和注意力网络的DNS隐蔽信道检测算法。该算法基于DNS请求与响应双向流,首先将残差结构和并行卷积相结合,采用不同大小的卷积核提取并融合多尺度特征信息,实现不同感受野特征的捕获;其次引入通道注意力机制增加卷积通道关键信息的提取能力,丰富网络模型的表达能力;最后采用softmax函数实现DNS隐蔽信道的检测。实验结果表明,所提模型能有效检测DNS隐蔽信道,平均准确率、精确率和召回率分别为96.42%、97.82%和96.16%,优于传统方法。
文摘DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了PFEC-Transformer(pcap features extraction CNN-Transformer)模型.该模型以表征后的十进制数值序列作为输入,在经过CNN模块进行局部特征提取后,再通过Transformer分析局部特征间的长距离依赖模式并进行分类.研究采集了互联网流量以及各类DNS隐蔽隧道工具生成的数据包构建数据集,并使用包含未知隧道工具流量的公开数据集进行泛化能力测试.实验结果表明,该模型在测试数据集上取得了高达99.97%的准确率,在泛化测试集上也达到了92.12%的准确率,有效地证明了其在检测未知DNS隐蔽隧道方面的优异性能.
