【作者】 陈晨；

【导师】 苏锐丹； 吴德；

【作者基本信息】 西安电子科技大学 ， 工程硕士（专业学位）， 2020， 硕士

【摘要】 随着网络信息化的高度发展,万物互联成为趋势,信息孤岛逐渐消弭,网络空间安全的重要性日益凸显,而保证网络空间安全的基础与关键技术就是密码技术。使用合规的密码、安全的密码,既是对公民个人合法权益的有力保障,也是对国家安全的有力保障。但从我国密码的应用情况来看,普遍存在使用密码的自觉性不够,密码应用不广泛、不规范及不正确等问题。因此,开展网络与信息系统中密码应用安全性评估工作具有十分重要的意义。针对以上问题,本文以《信息系统密码应用基本要求》为指导,设计并实现了集采集、分析、传输、存储与可视化为一体的密码应用安全态势感知平台。本平台通过对网络流量进行分析,判断网络中传输的数据是否被加密,使用的加密协议是否符合国家标准,协议中的密码参数是否合规,从而实现对网络与通信安全层面的密码应用的有效性、正确性与合规性的全面分析与评估。本平台由采集端和存储展示端两部分组成。采集端基于校园网完成网络流量数据的采集,通过数据包首部分析和分流处理,完成网络流量从数据包级别到数据流级别的转换。针对加密流量的识别,本文选择信息熵和蒙特卡洛π值作为衡量数据包负载随机性的标准,选用C4.5决策树算法构建分类模型。针对加密协议的识别,本文首先采用基于端口号的方法进行加密协议的快速识别,其次通过对SSL协议和IPSec协议的国际和国密标准进行深入分析和研究,采用基于DPI的方法对各加密协议的特征字进行提取和匹配,并从建立安全连接的过程中提取密码参数。本平台通过Apache Nifi完成采集端和存储展示端的数据流对接。平台存储展示端使用Logstash收集流量分析的结果,使用Elastic Search实现结果的存储与索引,并基于Vue、Echarts等技术结合ES实现交互式可视化展示。平台根据特定应用场景,通过设置密码参数字段值,定义检测策略,生成ES查询表达式对ES中存储的结果数据进行匹配,并给出检测结果,实现对网络中密码应用的合规性检测。最后,本文基于校园网络搭建了平台的测试环境,对平台进行功能测试与展示。测试结果表明,平台能够成功识别出加密流量及其使用的加密协议,在识别过程中能够提取所使用的密码参数以验证合规性,实现了预期的功能。更多还原

【Abstract】 With the high development of network information,the interconnection of all things has become a trend,the isolated island of information has gradually disappeared,and the importance of cyberspace security has become increasingly prominent.Cryptography is the basic core technology to ensure the security of cyberspace.Using compliant and secure cipher is not only a powerful guarantee for the individual legitimate rights of citizens,but also a strong guarantee for national security.However,according to the application of cryptography in our country,there are many common problems such as insufficient awareness of the use of cipher,using unpopular,irregular,and incorrect cipher and so on.Therefore,it is of great significance to evaluate the security of cryptography application in network and information systems.Aiming at the above problems,this paper takes the "General Requirements For Information System Cryptography Application" as a guide to design and implement a cryptography application security situation awareness platform that integrates collection,analysis,transmission,storage and visualization.This platform analyzes network traffic to determine whether the data transmitted in the network is encrypted,whether the encrypted protocol used is in compliance with national standards,and whether the encrypted parameters in the protocol are in compliance,thereby achieving a comprehensive analysis and evaluation of the validity,correctness and compliance of cryptography application at the network and communication security level.The platform consists of two parts: the capture side as well as the storage and display side.The capture side is responsible for the collection of network traffic based on the campus network,and completes network traffic conversion from packet level to flow level through packet header analysis and flow table processing.For the identification of encrypted traffic,this paper selects the Entropy and Monte Carlo π value as the standard to measure the randomness of the packet payload,and chooses the C4.5 decision tree algorithm to build the classification model.For the identification of encrypted protocols,this paper first uses the method based on port number to quickly identify encrypted protocols.Then,through indepth analysis and research on the international and national standards of the SSL protocol and IPSec protocol,this paper uses DPI-based method to extract and match the signatures of each encrypted protocol,and extracts the password parameters from the process of establishing a secure connection.The platform completes the data stream docking between the capture side and the storage and display side through Apache Nifi.The storage and display side uses Logstash to collect the results of the traffic analysis,and uses Elastic Search to store and index the results.Then,based on front-end technologies such as Vue and Echarts,the platform achieves interactive visual display by combining with ES.According to specific application scenarios,the platform implements compliance detection of the password application on the network through the following steps: setting password parameter field values,defining detection strategies,generating ES query expressions to match the result data stored in the ES,and finally giving detection results.Finally,based on the campus network,this paper builds a test environment for the platform,and performs functional testing and display on the platform.The test results show that the platform can successfully identify the encrypted traffic and the encrypted protocol used by the traffic,during the identification process,it can also extract encrypted parameters to verify compliance,and achieve the expected functions.更多还原