基于多尺度流分析的隐蔽信道检测模型与技术

As a kind of covert communication technology with network traffic as carrier, network covert channel is an important threat of critical network defense, and also an important concern of important network area perception. The covert channel traffic detection of specific target networks faces the challenges of complex and diverse, unidirectionality traffic and massive data environment, which needs more comprehensive and accurate modeling of network data traffic to improve the credibility of covert channel detection.In the framework of the multiscale Modeling theory of packet-flow-map, the key scientific problems of spatio-temporal sequence modeling of data flow and network entity communications map modeling are mainly solved, and the model of supporting network covert channel detection is constructed through real Internet big data. Based on the development of the bigdata-oriented network covert channel detection prototype system, the real-time and reliable detection for the initial network covert channel traffic and the network covert channel flow based on HTTP, DNS and SSL is realized, and the service node of the covert channel communication can further be found. This research can provide theoretical support and technical guarantee for the covert channel traffic detection of specific target networks.

网络隐蔽信道作为一种以网络流量为载体的隐蔽通信技术，是要害网络防御的重要威胁，也是重要网络区域感知的核心关切。特定目标网络隐蔽信道流量检测面临复杂多样、流量单向和海量数据的应用环境挑战，需要对网络数据流量进行更为全面和精准的建模以提高隐蔽信道检测可信性。为此，本课题提出基于多尺度流分析的隐蔽信道检测模型与技术的研究。在“报文-数据流-通联图谱”多尺度建模理论框架内，重点解决数据流的时空序列建模和网络实体通联图谱建模方法关键科学问题，并通过真实互联网大数据构造支持网络隐蔽信道检测的模型。在研制面向大数据的网络隐蔽信道检测原型系统的基础上，实现针对网络隐蔽信道初始连接和基于HTTP、DNS和SSL的网络隐蔽信道流量的实时可靠检测，并进一步实现隐蔽信道通信的服务节点的识别。本课题研究可为特定目标网络隐蔽信道流量检测提供理论支持和技术保障。

针对互联网大数据环境下的特定目标网络隐蔽信道流量检测的迫切需要，本课题开展了基于多尺度流分析的隐蔽信道检测模型与技术研究。在理论研究方面，构建了一种网络域名语义要素解析树模型和一种基于多尺度流量分析的一体化表征模型，有力支撑了隐蔽信道建联阶段和数传阶段的智能流量分析。在关键技术突破方面，分别提出了多种适应于不同对象和不同场景的DGA域名检测方法，分别提出了多种针对不同类型伪装混淆类隐蔽信道流量和未知加密累隐蔽信道流量的检测方法。在关键技术突破的基础上，研制了线路透视分析原型系统，验证了关键技术的有效性，并推动了基于关键技术设计的软件模块在国家网络空间治理的相关重点工程上成功应用，有力支撑了国家重大活动期间的网络环境治理。