利用包长特征的浏览器被动识别方法

doi:10.3969/j.issn.1001-2400.2017.06.025

西安电子科技大学学报

利用包长特征的浏览器被动识别方法

刘长江;万坚;韩杰思;魏强

(盲信号处理国家重点实验室，四川成都 610041)

收稿日期:2016-09-22 出版日期:2017-12-20 发布日期:2018-01-18
作者简介:刘长江(1991-)，女，盲信号处理国家重点实验室硕士研究生，E-mail: jiangjiangmails@sina.com
基金资助:
国家自然科学基金资助项目(61072067)

Passive browser identification based on the packet length

LIU Changjiang;WAN Jian;HAN Jiesi;WEI Qiang

(National Key Lab. of Science and Technology on Blind Signal Processing, Chengdu 610041, China)

Received:2016-09-22 Online:2017-12-20 Published:2018-01-18

摘要/Abstract

摘要：

浏览器作为用户使用最为频繁的网络应用软件，是黑客们的重要攻击目标．对于网络管理员而言，掌握网络中用户所使用的浏览器，可以及时发现用户主机可能存在的漏洞，便于采取防御措施．文中提出了一种利用请求数据包长度特征的浏览器被动识别方法，即利用不同浏览器在请求网页内容时发送的请求数据包长度的差异，通过聚类算法实现对浏览器的识别．实验表明，该方法对五类常用浏览器的识别率能达90％以上，并且所提特征指纹具有时间的稳定性．该方法不增加网络流量，不干扰网络正常运行，能够在非加密和加密情况下对网络中的浏览器进行识别．

关键词: 浏览器, 被动识别, 包长特征, 分类算法, 特征稳定性

Abstract:

The browser, as the most frequently used network application software, is an important target of hackers. For network administrators, mastering the browsers used by network users can help them to discover the possible vulnerabilities in the host computers and take defensive measures expediently. In this paper, we propose a passive browser identification method by requesting the packet length. We make use of the difference in requesting the packet length when using different browsers to request the web content, and then achieve the browser identification by the clustering algorithm. The experiment shows that the recognition rate of the five most common browsers can reach more than 90％ in this way, and the time stability of the fingerprinting is also confirmed. This method does not increase the network traffic or interfere with the normal operation of the network, and it can identify web browsers under the condition of both non-encryption and encryption.

Key words: browser, passive identification, packet length, classification, feature stability

刘长江;万坚;韩杰思;魏强. 利用包长特征的浏览器被动识别方法[J]. 西安电子科技大学学报, 2017, 44(6): 144-149.

LIU Changjiang;WAN Jian;HAN Jiesi;WEI Qiang. Passive browser identification based on the packet length[J]. Journal of Xidian University, 2017, 44(6): 144-149.

参考文献

［1］ MALWARETIPS. Desk Top Browser Share Trend［EB/OL］.［2016-04-15］. https: //malwaretips. com/threads/desktop-top-browser-share-trend. 5543/.
［2］ STATCOUNTER . Top 5 Desktop Browsers from Jan to Dec 2015［EB/OL］.［2016-04-15］. http: //gs. statcounter. com/#desktop-browser-ww-monthly-201501-201512-bar.
［3］ ECKERSLEY P. How Unique Is Your Web Browser?［C］//Lecture Notes in Computer Science: 6205. Heidelberg: Springer Verlag, 2010: 1-18.
［4］ NIKIFORAKIS N, KAPRAVELOS A, JOOSEN W, et al. Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting［C］//Proceedings of the IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2013: 541-555.
［5］王维, 王伟平, 王建新. 一种基于升级浏览器指纹的用户识别方法［C］//第七届信息安全漏洞分析与风险评估大会论文集, 2014: 189-197.
［6］ SUN Q, SIMON D R, WANG Y M, et al. Statistical Identification of Encrypted Web Browsing Traffic［C］//Proceedings of the IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2002: 19-30.
［7］ SHI Y, BISWAS S. Website Fingerprinting Using Traffic Analysis of Dynamic Webpages［C］//Proceedings of the 2014 IEEE Global Communications Conference. Piscataway: IEEE, 2015: 557-563.
［8］ YUAN Z L, XUE Y B, XIA W. PPI: towards Precise Page Identification for Encrypted Web-browsing Traffic［C］//Proceedings of the 9th ACM/IEEE Symposium on Architectures for Networking and Communications Systems. Piscataway: IEEE, 2013: 109-110.
［9］ GONG X, BORISOV N, KIYAVASH N, et al. Website Detection Using Remote Traffic Analysis［C］//Lecture Notes in Computer Science: 7384.Heidelberg: Springer Verlag, 2012: 58-78.
［10］ YU J, CHAN-TIN E. Identifying Webbrowsers in Encrypted Communications［C］//Proceedings of the ACM Conference on Computer and Communications Security. New York: ACM, 2014: 135-138.
［11］柏骏, 夏靖波, 钟赟, 等. 网络运行态势感知技术及其模型［J］. 解放军理工大学学报: 自然科学版, 2015, 16(1): 16-22.
BAI Jun, XIA jingbo, ZHONG Yun, et al. Network Runing Situation Awareness Technology and Its Model［J］. Journal of PLA University of Science and Technology: Natural Science Edition, 2015, 16(1): 16-22
［12］杨洁, 刘聪锋. 模式匹配与校验和相结合的IP协议识别方法［J］. 西安电子科技大学学报, 2012, 39(3): 149-153.
YANG Jie, LIU Congfeng. IP Protocol Identification Method Using the Pattern Match and Check Sum［J］. Journal of Xidian University, 2012, 39(3): 149-153.
［13］ HECKERMAN D. A Tutorial on Learning with Bayesian Networks［C］//Learning in Graphical Models. Cambridge: MIT Press, 1999: 301-354.
［14］ BREIMAN L. Random Forests［J］. Machine Learning, 2001, 45(1): 5-32.
［15］ CHAU M, CHEN H C. A Maching Learning Approach to Web Page Filtering Using Content and Structure Analysis［J］. Decision Support System, 2008, 44(2): 482-494.
［16］ ALEXA. The Top 500 Sites on the Web［EB/OL］. ［2016-04-20］. http: //www. alexa. com/topsites.

利用包长特征的浏览器被动识别方法

Passive browser identification based on the packet length

PDF (PC)

赞

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 1

Metrics

本文评价

推荐阅读 10