49 2 Vol. 49 No ADVANCED ENGINEERING SCIENCES Mar CTCIS 2016 DOI /j. jsuese Tor

Size: px

Start display at page:

Download "49 2 Vol. 49 No ADVANCED ENGINEERING SCIENCES Mar CTCIS 2016 DOI /j. jsuese Tor"

隆羽薛
4 years ago
Views:

1 49 2 Vol. 49 No ADVANCED ENGINEERING SCIENCES Mar CTCIS 2016 DOI /j. jsuese Tor Meek Tor Tor SVM Tor Tor-Meek Tor-Meek 7 Tor-Meek Tor-Meek Tor-Meek % Tor Meek 4 Tor-Meek 16 Tor-Meek SVM Tor-Meek Tor-Meek 40 Tor-Meek 97% 99% Tor Tor Tor TP A Identification of Tor Anonymous Communication with Cloud Traffic Obfuscation HE Yongzhong 1 2 LI Xiang 1 2 CHEN Meiling 1 2 WANG Wei Beijing Key Lab. of Security and Privacy in Intelligent Transportation Beijing Jiaotong Univ. Beijing China 2. School of Computer and Info. Technol. Beijing Jiaotong Univ. Beijing China Abstract In order to solve the problem of identifying the meek-based Tor anonymous traffic from the TLS-based cloud computing service traffic an identification method for Tor s anonymous communication based on traffic feature matching and a classification method of Tor s anonymous traffic based on SVM were proposed. Firstly based on the analysis of connection static packet and dynamic traffic of the captured Tor-Meek and non Tor-meek traffic in the lab environment seven specific static and dynamic features of Tor-Meek traffic were identified. Lately a traffic feature matching identification method for Tor s anonymous communication technique was proposed which could be used to quickly detect Tor-Meek traffic and the accuracy rate is over 90% for longer traffic with packets number exceeding 200. In order to be robust to the upgrading and transformation of Tor versions statistic features of the slicing of Tor-Meek traffic were analyzed including the length and count length variation length entropy sequence of sending and receiving of the sliced traffic. Then 16 statistic features were identified based on which an identification and classification method for Tor s anonymous traffic by u- sing SVM machine learning algorithm was proposed. Different feature combinations and algorithm parameters were studied experimentally to decide which ones can yield the best accuracy and recall rate of the classification algorithm. It was shown that when the number of packets in one session wa above 40 and the length of each slice of one session was 40 packets the identification accuracy was above 97 and the recall rate was over 99% for the SVM based method. The experiments results show that while the feature matching methods is yzhhe@ bjtu. edu. cn http / /jsuese. ijournals. cn http / /jsuese. scu. edu. cn

2 effective for quick identification the machine learning method is more accurate and robust to the changing and upgrading of different versions of Tor browser in identifying anonymous traffic of specific versions of Tor-Meek. Key words anonymous communication Tor traffic obfuscation traffic identification IANA Internet Assigned Numbers 1 Authority 1981 Chaum Mix 2 payload Anonymizer 3 Onion Routing 4 Mixminion 5 Crowds 6 DC-Net 7 P5 8 9 The second generation Onion Router Tor 2003 US Naval Research Laboratory Tor Tor Tor GB Tor Tor 4 Tor Tor Tor TLS Tor Tor Tor TLS Tor Tor TLS obfs3 obfs4 Meek Flash proxy FTE scramblesuit Tor Tor Tor 11 TLS ISIS Tor Tor ISIS Tor Tor Tor Tor Tor Browser 4. 0 Meek Meek Tor Tor HTTPS deep packet inspection DPI Meek 8 Tor

3 2 Tor 123 Meek HTTPS Tor Tor HTTPS Tor Tor-Meek Tor-Meek 1 Meek Amazon Azure Google Tor IP IP IP Tor-Meek 1 Tor 2 Meek Fig. 1 Network structure of Tor HTTPS Tor 3 onion router OR Tor TLS Tor Tor- OR Meek 3 Tor-Meek 4 directory server TLS Tor OR Tor-Meek 5 Bridge relays Bridge OR Tor OR Tor Tor-Meek 7 OR 4 16 Bridge Tor SVM 6 Bob Tor Bob Meek Tor Alice Tor Bob Alice OP Tor 1 Tor Meek Tor OP 1. 1 Tor Tor 3 Tor Tor 1 Bob Alice OP Alice 1 Alice Tor Tor Alice Tor Bridge 14 Tor Tor 2 onion proxy OP OR Alice Tor Tor OP Tor Tor Tor Tor Tor OR

4 fronting HTTP HTTP-based tun- Tor neling proxy Tor HTTP HTTP Tor Tor Meek 1. 2 Meek allowed. example Tor forbidden. example Tor Browser4. 0 Meek TLS pluggable transport Tor HTTP Host header HTTPS Tor Tor Tor Tor Meek-Amazon Meek-Azure HTTP Meek-Google 3 Meek Meek Tor Tor Meek Meek Meek domain Meek 2 2 Meek Fig. 2 Meek s schematic diagram Meek Tor Tor Tor TP Meek Meek HTTP Tor TLS Tor TLS Tor Meek 17 Tor 2 Meek Meek Tor HTTP POST Tor Tor Meek Meek HT- polling request TP Tor Tor Tor 100 ms Meek Tor 5 s HT Meek Tor TLS Meek session HTTPS ID Meek HT- Meek TP session ID Meek Tor Browser Firefox HTTPS session Meek ID Tor

5 2 Tor 125 Meek 2. 1 Tor-Meek Meek Meek Tor Meek Tor Browser Meek Tor Browser PC DNS Meek PC HTTP Meek TLS HOST Header TLS SNI http / /appspot. com http / /www. google. com TLS Meek Tor 2 HTTP 15 Tor-Meek Meek Tor-Meek TLS Tor Tor Meek HTTP Tor-Meek Meek Meek HTTP Tor Wireshark HTTP Meek Meek 2 TLS Wire TLS Cipher Suits shark Tor Browser Meek Wireshark Tor Browser TLS Client Hello Meek TLS TLS PC Meek TLS TLS Meek TLS TLS IP TCP IP HTTPS TLS Meek TLS TLS TLS session ID TLS Meek HTTP Meek TLS Client Hello Cipher Suits Cipher Suits Cipher Suits Tor Meek Tor Tor Browser Tor Browser Firefox ESR Tor Browser Meek ~ TLS Cipher Suits Firefox ESR Meek TLS TLS Cipher Suits 2 TLS TLS Extensions Cipher Suits Extensions Meek TLS Client Hello Extensions Tor 3 TLS Browser TLS Client Hello 4 Extensions Extensions TLS Tor-Meek TLS Server Name Meek Meek TLS

6 Client Hello extension server name TLS Meek-Amazon https / /a0. awsstatic. com / Meek-Azure https / /ajax. aspnetcdn. com / Meek TLS Meek Tor Browser Firefox 38 ESR netmarketshare 18 Meek Firefox % Firefox Amazon ht- Meek tps / /a0. awsstatic. com / Azure https / / Meek Tor Meek ajax. aspnetcdn. com / 100 ms 1 Meek TLS TLS HTTP Meek Meek Meek Meek TLS 2 50% 5 s Meek TLS Meek TLS Meek Meek Meek-Amazon TLS Meek 209 byte 395 byte Meek-Azure 202 TLS TLS byte 383 byte SSL Meek TLS 1 ClientHello Tor SSLv3 TLS 2 Browser 2 ClientHello Cipher Suits Meek 3 Meek 3 ClientHello Cipher Suits Meek 2. 2 Tor Tor Meek 5 Meek TLS Meek Meek TLS Meek TLS Meek 6 Meek TLS Meek TLS TLS Client Hello Cipher Suits Extensions Server Name Tor Browser TLS Client Hello Client Hello Cipher Suits Extensions Server Name Meek 4 ClientHello Extensions 5 ClientHello Extensions 6 ClientHello Server Name

7 2 Tor 127 Meek 3 SVM TLS Meek Meek TLS Client Hello TLS Meek PC Meek TLS Meek Meek TLS Meek TLS Meek Meek TLS Meek TLS Tor TLS 3 Tor Meek TLS Tor TLS Meek Meek 1 TLS Meek-Amazon Meek-Azure Meek Meek TLS 2 TLS Meek SVM 19 Tor Meek Meek Meek Meek 100 ms Meek Meek Meek Meek TLS % ms 2 Meek TLS 5 s TLS 5 s Meek TLS Meek 11 Meek 100 ms 5 s Meek Tor Meek Meek Meek Tor Meek TLS Meek Meek Meek Tor Tor pollingscore 8 Meek Tor Meek Meek 1 Meek pollingscore Meek Meek n Meek Meek a n TLS Meek Meek Meek

8 Meek Meek Meek Meek 3 SVM Meek Tab. 1 1 Flag value and normalization method / / / / / / / / /3 /3 /3 / / / / Internet recall accuracy recall = TP / TP + FN accuracy = TP + TN / TP + FN + FP + TN Fig. 3 3 Topology of system network

2 Meek-Amazon Tor Browser 4. 2 Meek- Meek Azure Tor Browser 5. 2 Meek-Azure Tor Browser 5. 5 Meek 40 Meek-Azure Tor Browser 6.0 Meek-Azure Meek 40 ~ 99 100 ~ 199 200 ~ 299 5 739

9 2 Tor 129 TP TN FP FN 4. 3 Tor Meek TLS Meek Meek Meek 5 IPv4 Fig. 5 Accuracy rate of IPv4 s flow recognition Firefox Amazon TLS Tor-Meek Meek 40 Meek IPv4 0 Meek 200 Meek 90% 2 Meek TLS Meek TLS TLS TLS Tor Browser Meek TLS Tor Browser Meek Meek Tor Browser 4. 2 Meek-Amazon Tor Browser 4. 2 Meek- Meek Azure Tor Browser 5. 2 Meek-Azure Tor Browser 5. 5 Meek 40 Meek-Azure Tor Browser 6.0 Meek-Azure Meek 40 ~ ~ ~ ~ Meek 522 IPv4 Meek IPv6 Meek Meek 1 11 Meek 70% 2 3 Tor Browser 4. X Meek 3 Meek Fig. 4 4 IPv6 40 Accuracy rate of IPv6 s flow recognition Meek Tor Browser 5. X 6. X Meek 90% 2 Tor Browser 4. X 2 40 Meek Meek 200 Meek 95% 2 Meek Meek Meek Meek TLS Meek 40 Tor Tor TLS Tor Browser 7

130 49 6 Fig. 6 314 SSL 1 10 5 IO SVM C-SVC Tor Browser Accuracy rate of tor s different versions c 2 2 0 2 10 LibSVM 4. 4. 1 Meek 1 000 Meek 200 Meek 20 30 40 50 7 c Fig.

2 Accuracy rate of fragmentation sizes /% c = 1 c = 32 c = 128 c = 512 c = 1 024 20 88. 0 92. 5 93. 0 94. 0 93. 0 706 ms 30 89.

10 Fig SSL IO SVM C-SVC Tor Browser Accuracy rate of tor s different versions c LibSVM Meek Meek 200 Meek c Fig. 7 Accuracy rate of flow features matching Tab. 2 Accuracy rate of fragmentation sizes /% c = 1 c = 32 c = 128 c = 512 c = ms SVM SVM Tor SVM % c = c 99. 4% Meek

11 2 Tor 131 Meek Tab. 4 Accuracy rate of optimized identification /% c c A 5 B C Tab. 5 Recall rate of optimized identification D A + B /% c = 1 c = 32 c = 128 c = 512 c = Tab. 3 Accuracy rate of feature combinations /% c = 1 c = 32 c = 128 c = 512 c = A B C D A + B A + C A + D B + C + D A + C + D A + B + D A + B + C Tor + + Tor % Meek Tor 99. 5% c = Meek Meek SVM Meek 7 Tor-Meek Meek Meek TLS Client Hello Tor 40 SVM Tor 3 Meek Tor Tor Browser Meek 97% 4 99% 5 4 c = 1 c = 32 c = 128 c = 512 c = SVM 316 SSL IO ms 159 ms SVM 5 Tor Browser 4. 0 Meek Tor-Meek

12 檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾檾 Pfitzmann A K hntopp M. Anonymity unobservability and pseudonymity A proposal for terminology M / /Designing Privacy Enhancing Technologies. Heidelberg Springer Serjantov A. Anonymizing censorship resistant systems M / /Peer-to-Peer Systems. Heidelberg Springer-Velag 3 Reed M G Syverson P F Goldschlag D M et al. Anonymous connections and onion routing J. IEEE Journal on Selected Areas in Communication Danezis G Dingledine R Mathewson N. Mixminion Design of a type Ⅲ anonymous r er protocol C / /Proceedings of the 2003 IEEE Symposium on Security and Privacy. Oakland California IEEE Reiter M K Rubin A D. Crowds Anonymity for web transactions J. ACM Transactions on Information and System Security Chaum D. The dining cryptographer s problem Unconditional sender and recipient untraceability J. Journal of Cryptology Sherwood R Bhattacharjee B Srinivasan A. P5 A protocol for scalable anonymous communication J. Journal of Computer Security Zhao Guofeng Ji Chaoming Xu Chuan. Survey of techniques 殧檾檾檾殧 for Internet traffic identification J. Journal of Chinese Computer Systems Internet J Tor 9 Dingledine R Mathewson N Syverson P. Tor The secondgeneration onion router C. Conference on Usenix Security Tor Meek Symposium USENIX Association Tor 10 Tor Project EB /OL https / /metrics. torproject. org. 11 He Gaofeng Yang Ming Luo Junzhou et al. Online identification of Tor anonymous communication traffic J. Journal of Software Tor J Tor s documentation EB /OL https / /www. torproject. org /docs /documentation. html. en. 13 Dingledine R Mathewson N. Tor s protocol specifications EB /OL http / /tor. eff. org /cvs /doc / tor-spec. txt Tor s protocol specifications EB /OL https / /gitweb. torproject. org /torspec. git /tree /attic /bridges-spec. txt. 15 doc_meek EB/OL Tor bug tracker & Wiki. https / /trac. torproject. org/projects/tor /wiki /doc/ meek. 16 Fifield D Lan C Hynes R et al. Blocking-resistant communication through domain fronting J. Proceedings on Privacy Enhancing Technologies Chaum D. Untraceable electronic mail return addresses and digital pseudonyms J. Communications of the ACM netmarketshare EB /OL http / / www. netmarketshare. com /. 19 Vapnik V N. The nature of statistical learning theory M. New York Springer-Verlag 殧 He Yongzhong Li Xiang Chen Meiling et al. Identification of Tor anonymous communication with cloud traffic obfuscation J. Advanced Engineering Sciences Tor J 殧

2 3. 1,,,.,., CAD,,,. : 1) :, 1,,. ; 2) :,, ; 3) :,; 4) : Fig. 1 Flowchart of generation and application of 3D2digital2building 2 :.. 3 : 1) :,

2 3. 1,,,.,., CAD,,,. : 1) :, 1,,. ; 2) :,, ; 3) :,; 4) : Fig. 1 Flowchart of generation and application of 3D2digital2building 2 :.. 3 : 1) :, 3 1 Vol. 3. 1 2008 2 CAA I Transactions on Intelligent Systems Feb. 2008, (,210093) :.,; 3., 3. :; ; ; ; : TP391 :A :167324785 (2008) 0120001208 A system f or automatic generation of 3D building models