IP时间隐通道严重威胁着网络用户的信息安全,基于熵的检测方法是目前最有效的时间隐通道检测方法,可以检测已知的IP时间隐通道.而近期提出的Liquid时间隐通道将包序列分为两部分,通过相互间的补偿来有效地躲避了熵的检测.针对Liquid方法的特点,提出了基于滑动窗口的熵检测方法.该方法先利用滑动窗口找出隐信息包序列和补偿包序列,然后再基于正常通信和Liquid通信在这两种包序列间存在熵差异性的特点实现检测,大量实验结果表明该方法能够有效地检测出Liquid时间隐通道.%IP convert timing channel is seriously threatening the information security of network users. The detection method based on entropy is the most effective one so far, which can detect the known IP convert timing channel. And the liquid convert timing channel advanced recently divides the packet sequence into two parts, avoiding the entropy detection effectively by compensating each other. According to the characteristics of Liquid, the entropy detection method based on the slide window is proposed in the paper. The method firstly finds out the convert information sequence and the compensation packet sequence, and then carries out its detection on the basis of the entropy diversity existing in the two packet sequences of normal communications and Liquid communications. The results of many experiments indicate that the method can detect the liquid convert timing channel successfully.
展开▼
