基于HMM的网络隐蔽信道检测模型的研究-计算机应用技术专业论文.docxVIP

111111 111111 1 1 Itlll l ttl l Illll lllll tlllllq ，Y1 91 9609 硕士论文 摘 要 TCP／IP协议是当前网络的基石，它的存在给人们带来了很多便利，但是其自身的缺 陷为隐蔽信道的存在提供了可能性。通过隐蔽信道将机密的信息泄露出去无疑会对网络 安全造成很大的危害。为了减少隐蔽信道的威胁，研究隐蔽信道检测技术成为了新的课 题。 本文作者仔细研究了各种基于协议构建的隐蔽信道，分析了其传统的检测方法，在 此基础上，提出了一种新的检测方法，基于HMM模型的隐蔽信道检测方法。所建模型 分为以下几步：首先获取数据，进行特征提取，然后对正常网络行为建立HMM模型， 用模型输出的测试样本序列的概率来判断是否是异常行为。在对应用层的网络隐蔽信道 检测提出相应的模型后，引入K-Means算法对捕获的传输层数据进行预处理，使其量化 得到隐马尔可夫的观察序列，并将改进后的模型应用于传输层隐蔽信道检测。同时，本 文还提出了针对多种隐蔽信道检测的初步模型。通过实验来验证对应用层和传输层的隐 蔽信道检测的有效性，数据表明该模型的检测性能尚可，移植性也比较好。 关键词：网络隐蔽信道，检测模型，隐马尔可夫模型 Abstract Abstract 硕士论文 Abstract TCP／IP protocol is the cornerstone of the current network,its existence brought US a lot of convenience．However,due to its own shortcomings，鹤the existence of the covert channels provide the possibility．In order to reduce the harm of the coven channels，covert channel detection technology research has become a new topic． The author study a variety of covert channels based on protocol construction in this document,and analysis its traditional detection methods，on this basis，we propose a new detection method，the detection of covert charmel based on HMM modeL The model is divided into the following steps，we first obtain data and feature extraction．Then,construct the HMM model for the normal network behavior,and with the probability of the sequence of test samples that was outputted from this model determine that whether the behavior is abnormal．After proposing appropriate detection model for the application layer’S covert channel，using K-means algorithm we can pre-process the transport layer data be captured， obtain the observation hidden Markov sequence by sampling，and the improved model is applied to the detection of the transport layer’S covert channel．Meanwhile，the paper also raises the initial model for a variety o