CN107276978B - A kind of hiding service source tracing method of the Anonymizing networks of Intrusion Detection based on host fingerprint - Google Patents

Abstract

The present invention provides a method for tracing the source of anonymous network hidden services based on host fingerprints. The steps include: 1) Constructing a host fingerprint information database in the global IPv4 address space; wherein the fingerprint information of each host is obtained by all network services running on the host. 2) extract the fingerprint information of the ports opened by the anonymous network hidden service; wherein the fingerprint information of each anonymous network hidden service is identified by the union of the fingerprint information of all ports opened by the hidden service; 3) The fingerprint information of the anonymous network hidden service extracted above is matched in the host fingerprint information database of the global IPv4 address space, so as to realize the source tracing of the anonymous network hidden service. This method improves the efficiency of anonymous network hidden service traceability, and can be widely used to combat crimes using anonymous networks.

Description

A method for traceability of anonymous network hidden services based on host fingerprints

technical field

The invention relates to the source tracing direction of network attacks in the field of information security, in particular to a method for tracing the source of anonymous network hidden services based on host fingerprints.

Background technique

As a major privacy-enhancing technology, anonymous communication technology is widely used in all aspects of the Internet. The existing anonymous communication technology mainly uses multiple store and forward (using Mix network and onion routing technology) to change the appearance of messages (packet Delay, out-of-order, message filling, etc.), and use the refresh mechanism of the Mix network to eliminate the correspondence between messages, thereby providing privacy protection for online users. Typical low-latency anonymous communication systems include Tor, I2P, etc.

These anonymous communication systems not only protect the identity information of Internet users, but also protect the identity information of service providers. They allow users to provide network services on the premise of ensuring that the server IP is not leaked. We collectively refer to these hidden network services built on top of anonymous communication systems as "darknet". Such as Tor's Hidden Service, I2P's Eepsites.

However, while the unique anonymity of Tor and other anonymous networks protects the privacy of normal users, it also facilitates terrorists, rumor makers, cyber attackers, and illegal transactions such as drugs and pornography. Kaspersky Lab's report shows that the Tor darknet has become a shelter for botnets, malware command servers, and online black markets. Since 2013, illegal services hidden in the Tor network have increased rapidly. Kaspersky Lab has discovered At least 900 illegal services (including drug trading website silk road, botnet zombie, etc.) use the Tor network, using a total of 5,500 service relay nodes and 1,000 exit nodes. Studies have found that up to 32% of anonymous services on the Tor network involve pornography and drug dealing. In addition, anonymous communication tools are often used to transmit sensitive information and release rumors, etc. For example, Harvard students spread bomb rumors through Tor, Wikipedia leaked that Manning exchanged sensitive information through the Tor network, and Snowden used the Tor-based operating system Tails Pass on intelligence information.

The current methods for tracing the origin of anonymous network hidden services are mainly based on active and passive flow analysis or protocol vulnerability methods. There are also some works that study an anonymity cracking method based on attributes such as configuration and unique ID in web content. The anonymity cracking technology based on active and passive flow analysis requires the attacker to control the entry node (EntryGuard) of the anonymous network link at the same time, so as to monitor Internet users entering the entry node of the anonymous network and the entry node of the hidden service, and then use the time and Although this method has high accuracy, the probability that an attacker can control both the entry and exit nodes of an anonymous network is very low, and the protocol vulnerability method is often fixed by developers.

Contents of the invention

The purpose of the present invention is to provide a method for tracing the origin of anonymous network hidden services based on host fingerprints, which improves the efficiency of tracing the origin of anonymous network hidden services and can be widely used to combat crimes using anonymous networks.

For above-mentioned purpose, the technical scheme that the present invention adopts is:

A method for tracing the origin of anonymous network hidden services based on host fingerprints, the steps of which include:

1) Construct the host fingerprint information database of the global IPv4 address space; where the fingerprint information of each host (IPv4 address) is identified by the union of the fingerprint information of all network services running on the host;

2) extract the fingerprint information of the ports opened by the anonymous network hidden service; wherein the fingerprint information of each anonymous network hidden service is identified by the union of the fingerprint information of all ports opened by the hidden service;

3) Match the fingerprint information of the anonymous network hidden service extracted above in the host fingerprint information database of the global IPv4 address space, so as to realize the source tracing of the anonymous network hidden service.

Further, in step 1), an Internet-oriented (IPv4 address space) host fingerprinting method is used to construct a host fingerprint information base of the global IPv4 address space.

Further, the Internet-oriented host fingerprinting method refers to: for each host, identify the ports opened by the host through the Zmap network scanning program, and extract the fingerprint information of the network service running on the host.

Further, the fingerprint information of the network service refers to a hash value of inherent information of the network service.

Further, the fingerprint information in step 1) and step 2) includes fingerprint information of HTTP, HTTPS, SSH, IMAP(s), POP3(s), BitCoin network services.

Further, in step 3), the fingerprint information of the anonymous network hidden service extracted above is matched with the host fingerprint information database of the global IPv4 address space by using the inverted index-based fingerprint information fast query method.

Further, the inverted index-based fingerprint information fast query method refers to: for the fingerprint information of each host obtained in step 1), the fingerprint information of each network port is used as a keyword and the host is used as a value field to construct The inverted index query dictionary, and the fingerprint information of the anonymous network hidden service extracted in step 2) is searched in the inverted index query dictionary, and the query results corresponding to all fingerprint information are intersected to obtain the IPv4 address set of the anonymous network hidden service.

The beneficial effect of the present invention is that: the present invention provides a method for tracing the origin of anonymous network hidden services based on host fingerprints. The method first utilizes a large-scale network host scanning method to collect fingerprint information of each IPv4 host address to construct a global IPv4 address space Secondly, extract the fingerprint information of the anonymous network hidden service and match it in the host fingerprint information database of the global IPv4 address space. If the match is successful, it means that the hidden service is located on a certain IPv4 address, so as to crack its Anonymity to realize traceability of hidden services. This method has the following advantages:

1. Using the fingerprint information of the host to trace the source of anonymous network hidden services does not need to control any node in the anonymous network, which reduces the cost of anonymous network hidden service traceability;

2. Host fingerprint information and anonymous network hidden service fingerprint information are easy to obtain, without any traffic information in the anonymous network, which solves the problem of data acquisition;

3. This method only needs the fingerprint information of the host and the fingerprint information of the anonymous network hidden service to perform anonymous cracking, which greatly reduces the difficulty of tracing the source of the anonymous network hidden service.

Description of drawings

FIG. 1 is a flow chart of a method for tracing the origin of anonymous network hidden services based on host fingerprints according to the present invention.

Fig. 2 is a schematic diagram of the process of querying the IPv4 address of the anonymous network hidden service in the present invention.

FIG. 3 is a specific flowchart of a method for tracing the origin of anonymous network hidden services based on host fingerprints according to an embodiment of the present invention.

Detailed ways

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

The present invention provides a host fingerprint-based anonymous network hidden service traceability method, as shown in Figure 1, the steps include:

1) Construct the host fingerprint information base of the global IPv4 address space.

The present invention proposes an Internet-oriented host fingerprinting method, that is, for each host, through network scanning programs such as Zmap, identify the ports opened by the host, and extract HTTP, HTTPS, SSH, IMAP (s) running on the host. ), POP3(s), BitCoin and other network service fingerprint information; where the fingerprint information of each host is identified by the union of fingerprint information of all network services running on the host. And the network service fingerprint information that the present invention extracts is the hash value of the inherent information of the network service of a certain host computer, and this fingerprint information does not change with the change of time and client, as the type, version, protocol header of HTTP Server, HTTPS The server type, version, protocol header, certificate information, SSH public key information, etc., and its host fingerprint generation algorithm (that is, algorithm 1) are shown in Table 1. This algorithm uses the union of fingerprint information of network services of all open ports of each host to uniquely mark the host, and its target output is to associate the host with a set of fingerprint information to form an information base in the form of <IPv4,C> , and then construct the host fingerprint information base of the global IPv4 address space; where IPv4 is used to identify the host, and C is used to identify the fingerprint information set of the host.

2) Extract the fingerprint information of the anonymous network hidden service.

The invention proposes a method for extracting fingerprint information oriented to anonymous network hidden services, so as to extract the fingerprint information of anonymous network hidden services. For anonymous network hidden services, quickly scan to identify whether a hidden service is alive, verify whether a specific port is open, and then extract the fingerprint information of the open port; the fingerprint information of each anonymous network hidden service is obtained from all the hidden services opened by the hidden service. The union identifier of the fingerprint information of the port. The extracted fingerprint information includes fingerprint information of network services such as HTTP, HTTPS, SSH, IMAP(s), POP3(s), and BitCoin. Its anonymous network hidden service fingerprint generation algorithm (Algorithm 2) is shown in Table 2. This algorithm uses the union of the fingerprint information of all open ports of each anonymous network hidden service to uniquely mark the anonymous network hidden service, and its target output is to associate the anonymous network hidden service with a set of fingerprint information to form An information base in the form of <Onion, F>; where Onion is used to identify an anonymous network hidden service, and F is used to identify a fingerprint information set of the anonymous network hidden service.

Table 1: Host Fingerprint Generation Algorithm

Table 2: Anonymous Network Hidden Service Fingerprint Generation Algorithm

3) Match the fingerprint information of the anonymous network hidden service extracted above in the host fingerprint information database of the global IPv4 address space; if the match is successful, it means that the anonymous network hidden service is located on a certain IPv4 address, thereby cracking its anonymity To realize the traceability of anonymous network hidden services.

Table 3: Inverted Index Algorithm for Establishing Host Fingerprint Information in the Global IPv4 Address Space

Table 4: Fast matching algorithm for fingerprint information of anonymous network hidden services

The present invention proposes a fast matching algorithm for anonymous network hidden service fingerprint information to match the above extracted fingerprint information of anonymous network hidden service in the host fingerprint information database of the global IPv4 address space. This algorithm is a fast fingerprint information query method based on inverted index, that is, for the fingerprint information of each host obtained in step 1), use the fingerprint information of each network port as a keyword and the host as a value field to construct an inverted index query dictionary, and query the fingerprint information of the anonymous network hidden service extracted in step 2) in the inverted index query dictionary, and intersect the query results corresponding to all fingerprint information to obtain the IPv4 address set of the anonymous network hidden service. Table 3 shows the host fingerprint information inverted index algorithm (ie Algorithm 3) for establishing the global IPv4 address space, and the fast matching algorithm (ie Algorithm 4) for anonymous network hidden service fingerprint information is shown in Table 4. The input of Algorithm 3 is the host fingerprint information base of the global IPv4 address space built in step 1). The row index query dictionary is convenient for query. The inverted index query dictionary uses the host IPv4 address set with the same fingerprint information as the value field of the current fingerprint information. When the fingerprint information of an anonymous network hidden service is given, by querying the inverted index query dictionary, you can compare All possible host IPv4 address sets corresponding to the fingerprint information are obtained in a short time, which greatly improves query efficiency. The input of Algorithm 4 is the fingerprint information set F of an anonymous network hidden service. For each fingerprint information f in the set F, query the inverted index query dictionary constructed by Algorithm 3 in turn, and intersect the query results corresponding to all fingerprint information Set operation, then obtain the IPv4 address set S of the anonymous network hidden service.

Please refer to Figure 2, which describes the process of querying the host fingerprint information database of the global IPv4 address space to output the IPv4 address of the anonymous network hidden service given a fingerprint information set F of the hidden network service in the anonymous network. The said F is the hidden service of the anonymous network A set of fingerprint information, and each fingerprint information is represented by f. For example, an anonymous network hidden service opens three ports 22, 443, and 80, and the fingerprint information of the three ports is represented by f ₁ , f ₂ , and f ₃ respectively. The three fingerprint information are respectively queried from the inverted index query dictionary constructed based on the host fingerprint information base of the global IPv4 address space, and the corresponding IPv4 sets are denoted as S ₁ , S ₂ , and S ₃ , then the anonymous network hidden service corresponds to The IPv4 address of is S ₁ ∩S ₂ ∩S ₃ .

The following uses the Tor anonymous network as an example to explain the method of the present invention. The main steps and methods of other anonymous networks such as the I2P anonymous network are consistent with the Tor anonymous network.

Please refer to Fig. 3, for Tor anonymous network, adopt the method of the present invention to comprise the following steps:

The first step is to construct a host fingerprint information database of the global IPv4 address space; which specifically includes:

1) Add a blacklist, that is, set a blacklist for the IPv4 addresses corresponding to Alex's top 1 million domain names, so as to skip scanning of these IPv4 addresses.

2) Use open source tools such as Zmap to scan the entire network for common ports in the IPv4 address space (such as HTTP, HTTPS, SSH, IMAP(s), POP3(s), and BitCoin).

3) Based on step 1), each IPv4 open port is further scanned and verified at the protocol level to extract the protocol feature code, such as extracting its certificate information for the HTTPS protocol on port 443.

4) Construct the host fingerprint information database of the global IPv4 address space, and use the Redis cluster to establish an inverted index query dictionary with the fingerprint information of each network port as the key and the host as the value field, among which the host fingerprint of the global IPv4 address space is established The information inverted index algorithm (namely Algorithm 3) is shown in Table 3.

Step 2: Extract the fingerprint information of the anonymous network hidden service; it specifically includes:

1) Quickly scan the common ports of every anonymous network hidden service.

2) Based on step 1), further perform protocol-level scanning and verification on each open port of the anonymous network hidden service to extract the protocol signature, such as extracting its certificate information for the HTTPS protocol on port 443.

3) Generate fingerprint information according to the feature code of the anonymous network hidden service extracted in step 2), associate the anonymous network hidden service with its fingerprint information set, and record it as <Onion, F>, where Onion represents the anonymous network hidden service, and F is The fingerprint information collection of the anonymous network hidden service, and each fingerprint information is represented by f. For example, an anonymous network hidden service opens three ports 22, 443, and 80, and the fingerprint information of the three ports is represented by f ₁ , f ₂ , and f ₃ respectively.

Step 3: Query the fingerprint information of the anonymous network hidden service extracted above from the host fingerprint information database in the global IPv4 address space. Algorithm 3 is used to query the IPv4 address corresponding to the anonymous network hidden service to crack its anonymity and realize the traceability of the anonymous network hidden service.

The above implementation is only used to illustrate the technical solution of the present invention and not to limit it. Those skilled in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. Protection of the present invention The scope should be defined by the claims.

Claims (5)

1. a kind of Anonymizing networks of Intrusion Detection based on host fingerprint hide service source tracing method, step includes:

1) using the host finger print information storehouse of the host fingerprint mask method building global ip v4 address space of Internet；Its In each host finger print information by all operation network services on the host finger print informations and set identifier；It is described The host fingerprint mask method of Internet refers to: for each host, identifying the master by Zmap network scanner The open port of machine, and extract the finger print information of the network service of operation on the host；

2) finger print information that Anonymizing networks hide the open port of service is extracted；Wherein each Anonymizing networks hides the finger of service Line information by this hide the finger print information of the open all of the port of service and set identifier；

3) Anonymizing networks of said extracted are hidden to host fingerprint of the finger print information in the global ip v4 address space of service It is matched in information bank, is traced to the source with realizing that Anonymizing networks hide service.

2. the method as described in claim 1, which is characterized in that the finger print information of the network service refers to that network service is consolidated There is the cryptographic Hash of information.

3. the method as described in claim 1, which is characterized in that finger print information described in step 1) and step 2) include HTTP, HTTPS, SSH, IMAP (s), POP3 (s), BitCoin network service finger print information.

4. the method as described in claim 1, which is characterized in that quick using the finger print information based on inverted index in step 3) Querying method refers to the finger print information that the Anonymizing networks of said extracted hide service in the host of the global ip v4 address space It is matched in line information bank.

5. method as claimed in claim 4, which is characterized in that the finger print information method for quickly querying based on inverted index Refer to: the finger print information to each host obtained in step 1), using the finger print information of each network port as keyword, master Machine as codomain construct inverted index queries dictionary, and the query steps 2 in the inverted index queries dictionary) in extract anonymity The corresponding query result of all finger print informations is done intersection and obtains the hiding service of Anonymizing networks by the finger print information of network concealed service IPv4 address set.