1 of 20

網路攻防──暗網流量偵測

溫明浩　陳柏文　徐彥旻　周晁德

黃平瑋　蔡盺宇　劉記良�　

2 of 20

Outline

  • Motivation&Background
  • Framework
  • Contribution&Conclusion

​

3 of 20

4 of 20

Overall Tor usage has more than �doubled from 2012-2013 to 2015.

5 of 20

Problems with Dark Web

Child pornography

Guns

Trading of endangered species

​

Drugs

​

6 of 20

Network Packet

​

​

  • A network packet is a formatted unit of data carried by a packet-switched network.
  • A packet consists of control information
  • Header & Payload.

​

​

7 of 20

Packet Detection

​

  • Selected Feature
    • Task A : Flow IAT Min, Bwd IAT Std, Bwd IAT Mean, Bwd IAT Max
    • Task B : Flow Duration, Flow Bytes/s, Flow IAT Mean, Flow IAT Max, � Flow IAT Min, Fwd IAT Mean, Fwd IAT Max, Fwd IAT Min, � Bwd IAT Min�IAT : inter-arrival time

Reference : Characterization of Tor Traffic using Time based Features, 2017

8 of 20

Packet Classification

​

  • Machine Learning methods
  • KNN
  • Decision Tree
  • Random Forest

​

9 of 20

Content

  • Problem Description
  • Methods
    • Packet Detection
    • Packet Classification
  • Source code structure
  • Experiment & Result
  • Contribution

10 of 20

Source Code Structure

  • ​

11 of 20

Content

  • Problem Description
  • Methods
    • Packet Detection
    • Packet Classification
  • Source code structure
  • Experiment & Result
  • Contribution

12 of 20

Experiment

​

​

​

​

(our work / paper work)

​

​

Task A

Task B

knn

0.941689 / 0.940

0.693249 / 0.675

tree

0.945923 / 0.950

0.750214 / 0.728

forest

-

0.802460 / 0.760

13 of 20

Framework

Responsive web design(RWD)

14 of 20

Flow analysis

EXPRESS

REACT

15 of 20

  • EXPRESS calls Python
  • Python yields prediction and generates JSON format files
  • EXPRESS reads JSON format files and passes them to REACT

EXPRESS

REACT

16 of 20

Online Flow analysis

EXPRESS

REACT

17 of 20

  • Use tcpdump to dump pcap periodically
  • EXPRESS calls Python
  • Python yields prediction and generates JSON format files
  • EXPRESS reads JSON format files and passes them to REACT

EXPRESS

REACT

18 of 20

Contribution&Conclusion

​

​

  • Dark Web flow detection as a web service
  • Intuitive interface for users
  • On-line tracking mode

19 of 20

DEMO TIME!

20 of 20

QA