Hidden service publishing flow homology comparison using profile‐hidden markov model
Yitong Meng, Jinlong Fei · International Journal of Intelligent Systems · 2021
In recent years, web servers pay attention to privacy and anonymity protection and choose to rely on hidden service to avoid exposure of the real geographic locations. Several studies have confirmed that hidden service is vulnerable to flow correlation attacks, specifically, the attacker has the ability to synchronize the behavior of both sides of the communication after observing the flow for an extended period of time. However, since hidden service publish descriptor flow is transient behavioral traffic, automatically capturing and analyzing publish flow becomes a challenge. In this paper, our focus is the intelligent identification of the descriptor publishing flow. We propose a model for the descriptor publishing flow correlation attack (DPFCA). The model resolves the complex relationship between the circuit establishment flow and the publishing flow, and is able to intelligently process the sequence identification and content classification of the descriptor correlation flow of the existing version and tags. It is worth mentioning that the DPFCA is based on the automated homology comparison of the profile-hidden Markov model (PHMM). The descriptor publishing flow is converted to an amino symbol sequence and then compare with the known homologous sequence group in the library of Profile. The experimental results show that our model can achieve higher performance in terms of accuracy and reliability of transient flow identification compared with the traditional flow correlation attack model.