CAJ | 학술논문

匿名通信技术的滥用给网络监管带来了新的挑战.有效识别出匿名通信流量,是阻止该类技术滥用的前提,具有重要的研究意义和应用价值.现有研究工作侧重于匿名通信关系的确认,无法用于匿名通信流量的识别和阻塞.针对这个问题,围绕广泛使用的 Tor 匿名通信系统,深入分析运行机制,归纳总结其流量特征.在此基础上,分别提出基于 TLS指纹和基于报文长度分布的 Tor 匿名通信流量识别方法.对两种识别方法的优缺点和适用性进行了详细分析和讨论,并通过CAIDA数据集和在线部署对识别方法进行了验证.实验结果表明,基于TLS指纹和基于报文长度分布的识别方法均能有效识别出Tor匿名通信流量.
닉명통신기술적람용급망락감관대래료신적도전.유효식별출닉명통신류량,시조지해류기술람용적전제,구유중요적연구의의화응용개치.현유연구공작측중우닉명통신관계적학인,무법용우닉명통신류량적식별화조새.침대저개문제,위요엄범사용적 Tor 닉명통신계통,심입분석운행궤제,귀납총결기류량특정.재차기출상,분별제출기우 TLS지문화기우보문장도분포적 Tor 닉명통신류량식별방법.대량충식별방법적우결점화괄용성진행료상세분석화토론,병통과CAIDA수거집화재선부서대식별방법진행료험증.실험결과표명,기우TLS지문화기우보문장도분포적식별방법균능유효식별출Tor닉명통신류량.
@@@@Abuse of anonymous communication systems has introduced new challenges into network administration. The effective identification of anonymous communication traffic is a prerequisite to prevent such abuse;thus, this is fundamentally important for both theoretical researches and practical applications. Existing researches mainly focus on the confirmation of anonymous communication relationship and cannot be used to identify and block anonymous communication traffic. To solve this problem, the operation mechanism is deeply analyzed and traffic characteristics are summarized for the widely used Tor anonymous communication system. On this basis, a TLS fingerprint-based and packet-size distributions based methods are proposed to identify Tor anonymous communication traffic, respectively. The advantages, disadvantages and applicability of these two methods are analyzed and discussed in detail, and are validated by CAIDA dataset and online deployment. Experimental results prove that both methods are effective in identifying Tor anonymous communication traffic.