【作者】 陈阳；

【导师】 罗军舟； 吴文甲；

【作者基本信息】 东南大学 ， 计算机科学与技术， 2019， 硕士

【摘要】 近年来,匿名通信技术飞速发展,该技术通常利用内容加密、多跳转发、流量混淆等手段实现通信数据和通信关系的匿名化,使得匿名通信实体难以被关联和溯源。同时,借助匿名通信技术部署的隐藏服务,必须通过特殊的软件和配置才能访问,而大量隐藏服务形成了暗网。由于暗网中充斥着大量非法活动,包括毒品交易、军火买卖、色情信息、黑客攻击等,已严重影响和危害网络空间安全和人们日常生活,因此亟需通过技术手段来加强暗网的监管和治理,其中对匿名通信网络的识别与发现尤为重要。针对当前主流的匿名通信网络I2P,如何设计综合应用多种途径、具有较好健壮性的匿名节点和隐藏服务大规模发现方法,如何利用协议特征快速识别I2P流量,如何针对隐藏服务设计定位追踪方法,都是在I2P监管领域亟待解决的关键技术问题。针对上述问题,本论文的研究工作包括以下四个方面:首先,根据I2P的拓扑特点,设计并实现一种综合主动补种、节点感知、节点查询三种方式的I2P拓扑发现方法,实验过程中发现的节点数量达10万以上,验证拓扑发现方法的有效性;其次,针对I2P中有载荷的TCP流量,分析流量的报文长度序列特征和报文长度分布特征,并建立机器学习的分类模型,其识别率大于98%,能够有效识别I2P中的TCP流量;然后,依据I2P隐藏服务的域名和管理机制,设计并实现一种综合官方信息获取、搜索引擎信息获取、节点感知、链接扩展等方式的I2P隐藏服务发现方法,并在较长时间的实验中获得约一千万条暗网链接和大于150 GB的隐藏服务数据信息。设计基于流水印的隐藏服务定位方法,并验证多种频率水印信号的有效性;最后,整合I2P网络拓扑发现、I2P网络流量识别、I2P隐藏服务发现和定位的研究成果,设计并实现I2P匿名通信网络的识别与发现原型系统,并对系统功能进行测试与验证。综上所述,本论文分别研究I2P的网络拓扑发现方法、I2P网络流量识别方法和I2P隐藏服务发现和定位方法,并在此基础上实现I2P匿名通信网络的识别与发现原型系统,可为I2P匿名网络监管提供重要的技术支撑。更多还原

【Abstract】 In recent years,anonymous communication technology has been developing rapidly.In general,this technology employs content encryption,multi-hop forwarding,traffic confusion and some other means to anonymize communication data and communication relationships,which makes it difficult to associate and trace anonymous communication entities.Moreover,hidden services deployed by anonymous communication technology can only be accessed through special software and configuration.As a result,a large number of hidden services form the darknet.Inundated with illegal activities including drug trafficking,arms trade,pornographic information,hacking,the darknet has seriously affected and jeopardized cyberspace security and people’s daily life.Therefore,it is urgent to strengthen the supervision and governance on the darknet through technical means.The identification and discovery of anonymous communicationn network is of great significance.In terms of the current popular anonymous communication network I2 P,the supervision on I2 P cries for answers to the key technical problems including the design of the method that employes comprehensive ways and boosts robustness for large-scale discovery of anonymous node and hidden services,quick identification of I2 P traffic by protocol features,and the design of a method to locate and trace hidden services.To address these issues above,the research work of this thesis includes the following four aspects.Firstly,according to the topological features of I2 P,we design and implement an I2 P topology discovery method that integrates active replication,node awareness and node query.The number of nodes found in the experiment is over 100,000,which proves the effectiveness of the topology discovery method.Secondly,as for the loaded TCP traffic in I2 P,the features of message length sequence and message length distribution are analyzed.The classification model of machine learning is established with the traffic recognition rate over 98%,which can effectively identify the TCP traffic in I2 P.Thirdly,based on the domain name and management mechanism of I2 P hidden services,an I2 P hidden service discovery method is designed and implemented,which integrates official information acquisition,search engine information acquisition,node awareness,link expansion and so on.After a relatively long-term experiment,about 10 million darknet links and more than 150 GB hidden service data information are obtained.Furthermore,a stream-watermaing-based hidden service location is designed and employed to verify the validity of various frequency watermarking signals.Finally,according to the research results of I2 P network topology discovery,I2 P network traffic identification,I2 P hidden service discovery and location,a prototype system of I2 P anonymous communication network discovery and identification is designed and implemented,and the functions of this system are tested and verified.To sum up,this thesis studies the methods of I2 P network topology discovery,I2 P network traffic identification and I2 P hidden service discovery and location.On this basis,we implement a prototype system of I2 P anonymous communication network discovery and identification,which plays a great role in I2 P anonymous network supervision.更多还原