基于行为分析的新媒体信息隐藏分布式检测技术研究

Aiming at the requirements of distributed information hiding detection in the new media environment, we will study the unique distributed detection principles and models based on network behavior analysis for new media steganography theoretically and explore the means of achieving methodologically. First of all, in this project, we propose the behavior model of covert communication which is based on bipartite multigraph. Secondly, we will study subject feature extraction technology based on connectivity analysis and object feature extraction technology based on edge attributions. Moreover, the dedicated behavior sequence description language and its semantics verification technology will be researched. Then, we need to research the formal behavior sequence association framework based on feature mapping of behavior sequences and verify the characteristics of associating operations. After that, the technologies of distributed steganography behavior analysis engine will be studied, including the distributed search and synthesis algorithm for isomorphic bipartite graph, distributed feature retrieval algorithm for behavior sequence, efficient conversion algorithm for table structure, caching algorithm for intermediate subgraph results, cache update algorithm and detection engine’s performance evaluation model. Finally, we will analyze and validate these technologies by experiments. Through the implementation of this project, we can establish the theoretical basis of distributed detection of new media steganography and achieve a critical technical breakthrough. This work, which is a high value academic project, reflects the trend in the field of information hiding detection and combines the latest achievements of steganalysis and distributed detection. Meanwhile, our research has great practical value in reducing the insider threats of information system.

本项目针对新媒体环境中的信息隐藏分布式检测需求，在理论上研究基于网络行为分析的隐写者分布式检测原理和模型，并在方法上探索其实现手段。研究内容主要包括：提出基于二分多重图的隐写者网络通信行为模型；研究基于连通度分析的主体特征提取技术与基于边属性的客体特征提取技术；研究语义可验证的行为序列特征描述语言；研究基于行为序列特征映射的形式化行为序列关联框架以及关联操作的关键性质验证技术；研究高效分布式隐写行为检测引擎的关键技术，包括同构二分图分布式查找算法与合并算法、行为序列特征分布式检索算法、表结构高效转换算法、中间结果的缓存算法、缓存更新算法和检测引擎性能评估模型，并通过实验进行性能分析和功能验证。本项目的研究工作结合了隐写分析和分布式检测技术的最新成果，体现了信息隐藏检测与取证领域的发展趋势，具有很高的学术起点，同时也是阻断信息系统内部威胁、确保安全的核心关键技术，具有非常高的实用价值。

本项目针对新媒体环境中的信息隐藏分布式检测需求，以网络用户行为为主要研究对象，从原理模型和差异性特征提取关键技术两个方面开展较为系统和深入的研究，取得了一系列研究成果，具体表现在：（1）提出和完善了新媒体环境下信息隐藏检测框架（包括基于客体关联度的异常检测模型、基于形式化行为特征序列的异常检测模型、基于深度学习的数据投毒异常检测模型等），提出了适用于新媒体环境下的客体行为序列模型和形式化模型；（2）在关键技术层面，设计并实现了基于客体关联度的特征提取方法（包括复用率特征、相关度特征和真实度特征）、基于二分多重图建立用户行为形式化模型、设计基于用户行为形式化序列的特征提取方法（包括用户主体关联度特征、时序特征和用户文本内容特征）等一系列关键算法和技术，研发了软件应用系统和专用硬件设备，并将研究成果实际应用于重大工程。项目组在执行期内共发表学术论文6篇（其中EI检索论文4篇），申请专利6项。通过本项目的培养，培养硕士研究生5名。综上所述，本项目的研究工作是可以广泛应用于新媒体环境下信息隐藏检测的核心关键技术，能够大幅度提升我国信息服务平台的安全性，具有非常高的实用价值。