Research On Several Typical Covert Communication Detection Techniques In Audio And Video Traffic Submitted By Chang Tingting

Network covert communication is a kind of technology in which the sender hides the secret information in the hidden carrier of the massive data flow on the Internet.Because of its strong concealment,it is an important threat to network information security.In recent years,audio and video data streams will continue to grow.Network covert communication based on audio and video traffic poses a serious threat to network security.In view of this,this thesis studies the covert channel detection technology in the current mainstream audio-video communication solutions.The main work is as follows:1.This thesis introduces several current mainstream audio and video communication schemes,summarizes the development status of network covert channel and its detection technology based on them,and then analyzes the research content of the whole thesis.2.Aiming at the research of covert communication detection algorithm based on Skype traffic,this thesis proposes a neural network detection method based on Xgboost model learning.The Markov transfer characteristics,information entropy,kurtosis and skewness,mean and variance,DCT coefficient,?-similarity and standard deviation difference of Skype communication flow were extracted by the designed method.After 50% fold cross-validation,XGBoost was used to make the judgment.Compared with existing methods,the proposed method can achieve higher detection rate and reduce false alarm rate effectively.3.The research on detection algorithm for covert channel based on video packet loss shows that conditional entropy can effectively detect the sequence of repeated operation commands at the sending end.However,since the selection of single point value and sequence length has a great impact on conditional entropy,a detection method based on correction entropy is introduced in this thesis.The experimental results show that the detection method based on corrected entropy can overcome the influence of single point value on the results,and can effectively detect the covert channel under different sequence lengths.4.Covert channel based on adjusting the quiet period to carry out the detection algorithm research,design and implements a detecting method based on model integration,first to extract the kurtosis of skewness,quarterback spacing,correlation coefficient matrix three characteristics,experimental results show that a single test results of the model is affected by the inspection window size,it is difficult to guarantee the detection effect of a single model,For the effect of the integrated model,the average detection rate of the integrated model is higher for different window sizes.Finally,the thesis summarizes the main research content,summarizes the existing shortcomings,and points out the direction of further research.