一种基于多维特征分析的网页代理服务发现方法

陈志鹏; 张鹏; 黄彩云; 刘庆云; 邢丽超

引用本文：

陈志鹏,张鹏,黄彩云,刘庆云,邢丽超.一种基于多维特征分析的网页代理服务发现方法[J].信息安全学报,2018,3(4):41-53 [点击复制]
CHEN Zhipeng,ZHANG Peng,HUANG Caiyun,LIU Qingyun,XING Lichao.A Web Proxy Detection Method based on Multiple Feature Analysis[J].Journal of Cyber Security,2018,3(4):41-53 [点击复制]

本文已被：浏览 7271次下载 7142次	码上扫一扫！
一种基于多维特征分析的网页代理服务发现方法
陈志鹏^1,2, 张鹏², 黄彩云^1,2, 刘庆云², 邢丽超^1,2
0 字体:加大+\|默认\|缩小-
(1.中国科学院大学网络空间安全学院, 北京中国 100049;2.中国科学院信息工程研究所信息内容安全技术国家工程实验室, 北京中国 100093)

摘要:

网页代理提供了一种快捷的中继服务，与其它类型的代理服务相比，如隐匿网络/VPN服务/Socks代理等，用户可以不需要安装任何软件就免费使用。因此，网页代理在绕过访问限制、隐藏身份等方面的便利性上有其不可比拟的优势。然而，网页代理在获取个人隐私信息、推送垃圾广告、隐匿行踪等方面也给人们的网络生活带来严重的安全威胁。所以，如何快速有效地将它们与大量正常网页区分开来成为网络空间安全面临的一个重要挑战。针对这一问题，本文提出了一种基于多维特征分析的网页代理发现方法——ProxyMiner。在主动发现方面，引入了网页代理特有的结构特征和内容特征，通过机器学习的方法进行预测发现。在被动发现方面，基于用户访问网页代理特有的访问模式，通过构建二分图对代理用户进行谱聚类分析，获取代理用户群体访问的顶级域名，从而发现网页代理。此方法仅基于客户端IP地址和目标URL，不需要任何有关HTTP头（经常会被恶意修改）或数据包（通常是加密的或不可用的）的信息。实验结果表明，在相同数据集上，相比于传统检测方法，ProxyMiner可以显著提高网页代理检测效果，降低平均检测时间。

关键词: 网页代理服务发现主被动结合谱聚类分析

DOI：10.19363/J.cnki.cn10-1380/tn.2018.07.04

投稿时间：2018-03-30修订日期：2018-05-30

基金项目:本课题得到国家重点研发计划（No.2016YFB0801304）的资助。

A Web Proxy Detection Method based on Multiple Feature Analysis

CHEN Zhipeng^1,2, ZHANG Peng², HUANG Caiyun^1,2, LIU Qingyun², XING Lichao^1,2

(1.School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China;2.State Key Laboratory Of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China)

Abstract:

Web proxies offer a quick and convenient solution for routing web traffic towards a destination. In contrast to more elaborate relaying systems, such as anonymity networks, VPN services or Socks proxies, users can freely connect to web proxies without installing any special software. Therefore, web proxies are an attractive option for bypassing restrictions and hiding identity. However, it has become a much more serious problem for personal privacy, malicious advertisements and property safety due to its dynamics, and evasiveness. Therefore, how to quickly and effectively detect the web proxies from a large number of web pages is an important challenge. To solve this problem, this paper presents an active and passive web proxy detection method based on multiple feature analysis, named ProxyMiner. On the active side, the DOM features unique to Web proxy are introduced, and the method of machine learning is used for predictive analysis. On the passive side, based on the access model specific to the proxy service user, spectral clustering analysis is performed on the proxy user by constructing a bipartite graph, and the top-level domain names accessed by the proxy user group are obtained to discover the proxy service. This method is based solely on the client IP address and the destination address, and does not require any information about HTTP headers (often maliciously modified) or data packets (usually encrypted or unavailable). The experimental results show that ProxyMiner can significantly improve the detection performance and reduce the average detection time compared to traditional detection methods.

Key words: web proxy service discovery active and passive spectral clustering analysis