주성분 분석과 머신러닝 기법을 활용한 Tor 네트워크 웹사이트 핑거프린팅 연구
A Study of Tor Network Website Fingerprinting using Various ML Methods with PCA
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
Tor는 The Onion Router의 약자로서, 네트워크 패킷을 다수의 중계 서버(라우터)를 통해 랜덤화된 라우팅 경로를 이용하는 방식으로 웹 트래픽을익명화하여 사용자의 프라이버시를 보장한다. 최초에는 미국 해군 연구소(Navy Research Lab)에 의해 정부 온라인 통신 내용 보호의 목적으로 개발되었으나, 현재는 다크 웹(dark web) 등 각종 범죄에 악용되어 문제가 되고 있다. 본논문에서는 Tor 네트워크의 사용자와 진입 노드에서 발생하는 웹사이트트래픽에 주성분 분석(PCA)과 다양한 머신러닝 기법을 적용하여 Tor 네트워크웹사이트를 식별하는 웹사이트 핑거프린팅을 수행하였다. 구체적으로, 패킷의방향으로만 이루어진 데이터셋에 총 4개(뉴럴 네트워크(Neural Network), 랜덤포레스트(Random Forest), K-최근접 이웃(K-Nearest Neighbor), 서포트 벡터머신(Support Vector Machine))의 머신러닝 기법에 PCA를 추가로 적용한 결과, 머신러닝 기법만 사용한 기존 방식에 비해 웹사이트 핑거프린팅 정확도가 각각92% → 94%, 61% → 91%, 23% → 92%, 82.9% → 90.7%로 최대 69% 향상되는것을 확인할 수 있었다. 이러한 실험 결과를 바탕으로 우리는 Tor 네트워크의웹사이트 핑거프린팅 구현 방안 및 방어 대책에 대해 논의하고, 최종적으로 국방네트워크의 보안 강화에 대한 시사점을 제시하고자 한다
Abstract
Tor is the abbreviation of The Onion Router. Tor guarantees user privacy by anonymizing the web traffic using the way of utilizing the randomized routing routes through the numerous relay servers(routers). At first, Tor was developed for the protection of the government's online communication, but it has been misused for diverse crimes such as dark web, recently. In this research, we study Tor network website fingerprinting by adapting various ML methods with PCA in Tor network traffic, which is generated between the user and the entry node. Specifically, we adapt 4 machine learning algorithms (i.e., Neural Network, Random Forest, K-Nearest Neighbor, Support Vector Machine) with PCA to the dataset that contains only packet direction. In the experimental result, our novel way outperforms much better compared to the original machine learning algorithm. The classification accuracy improves by up to 69%, and the amount of learning time decreases by about at least 45%. Based on this result, we discuss the implementation of Tor network website fingerprinting and defense measures. Finally, we present the implications to strengthen the security of the military network.
참고문헌 (33)
- "Users - Tor Metrics" (2021)[URL]
- "다크웹의 현황 및 시사점"[URL]
- "북한 해커들, 청와대 노리는 정황 포착"[URL]
- Dingledine, Roger, "Tor: The second-generation onion router" (2004), Naval Research Lab Washington DC
- Ghaleb, T. A., "Wireless", website traffic analysis & fingerprinting: a survey of attacking techniques and countermeasures, 2015 (2015), 1~7[DOI]
- D. Herrmann, "Website fingerprinting: attacking popular privacy enhancing technologies with the multinomialnal Naive-bayes classifier", Proceedings of the 2009 ACM workshop on Cloud computing security, pp.31~42 (2009), ACM
- Andrjy Panchenko, "Website fingerprinting in onion routing based anonymization networks", ACM Workshop on Privacy in the Electronic Society(WPES), pp.103~114, ACM
- Wang Tao, "Improved website fingerprinting on tor", Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society (2013)
- Wang Tao, "Effective attacks and provable defenses for website fingerprinting", 23rd USENIX Security Symposium. USENIX Security, 14, pp.143~157
- Hayes, Jamie, "k-fingerprinting: A robust scalable website fingerprinting technique", 25th USENIX Security Symposium. USENIX Security, 16 (2016)
- Sirinam, Payap, "Deep fingerprinting:Undermining website fingerprinting defenses with deep learning", Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp.1928~1943 (2018)
- Rimmer, V., "Automated website fingerprinting through deep learning" (2018), NDSS
- Bhat, S., "Var-CNN and DynaFlow : Improved Attacks and Defenses for Website Fingerprinting", ~ (2018)
- Oh, Se Eun, "p1-FP: Extraction, classificati on, and prediction of website fingerprints with deep learning", Proceedings on Privacy Enhancing Technologies (2019)
- "Alexa Top Global Site"[URL]
- Oseledets, Ivan V., "Breaking the curse of dimensionality, or how to use SVD in many dimensions", SIAM Journal on Scientific Computing, 31(5), pp.3744~3759 (2009)
- Khalid, S., "A survey of feature selection and feature extraction techniques in machine learning", science and information conference, pp.372~378 (2014), IEEE
- "A Step-by-Step Explanation of PCA"[URL]
- "Chapter 2. Linear Algebra"[URL]
- "Principal Component Analysis"[URL]
- M. Anthony, "Neural network learning: Theoretical foundations" (2009), cambridge university press
- "Deep Learning 101"[URL]
- "Sequential model"[URL]
- Random Forests –-Random features, "Leo Breiman", Statistics Department, University of California Berkeley, ~, pp.Technical Report 567 (1999)
- "Random Forest"[URL]
- Shichao Zhang, "Learning k for kNN Classification", ACM Trans. Intell. Syst. Technol, 8(3), pp.19~ (2017)
- "How to find the optimal value of k in knn"[URL]
- M. A. Wajeed, "Different similarity measures for text classification using KNN", 2nd International Conference on Computer and Communication Technology (ICCCT-2011), pp.41~45 (2011)
- Cortes, Corinna, "Support-vector networks", Machine learning, 20(3), pp.273~297 (1995)
- Ritsch, Gunnar, "Soft margins for AdaBoost", Machine learning, 42(3), pp.287~320 (2001)
- "SVM"[URL]
- "PCA"[URL]
- "Grid Search CV"[URL]