利用統計方法提升行動裝置硬體指紋之準確率

Abstract

硬體裝置識別是網路安全中非常重要的議題。攻擊者可能使用竊取或是假造的身分去進行非法的行為或攻擊，這使得蒐集證據變得更為困難。之前的研究中提出一個稱為遠端硬體裝置指紋的技術，利用從裝置送出的TCP封包中取出時間戳記內包含的時間訊息計算出該裝置的時間歪斜誤差(clock skew error)來做為該裝置的硬體指紋。但時間歪斜會因為硬體的特性和網路的傳輸延遲而變的不穩定，特別是對行動裝置來說這個不穩定更為的明顯。在此篇論文中我們利用統計的模型來提升行動裝置硬體指紋的準確率。並且根據這個行動裝置硬體指紋的技術提出了一個偽造身分檢測的方法。實驗的結果顯示我們提出的方法可以有效的偵測出偽造身分攻擊，並且相較於之前的研究有著更高的準確度。

Device identification is one of the most important issues to Internet security. An adversary can take illegal actions with stolen or forged identity that makes evidence collecting to be very difficult. Previous work introduces an intuitive method that identifies a device by its clock skew. Unfortunately, the clock skew of a device is instable over time in the mobile environment due to the characteristics of the hardware and the instability of network latency. In this paper we adapt a statistical method inspired by EWMA model that characterizes the tendency of clock skew changes to improve the accuracy of mobile device fingerprinting. We also propose a device identity spoofing detection scheme based on the improved mobile device fingerprinting technique. The experiment result shows that the proposed scheme effectively detects identity spoofing attacks with higher accuracy compared to prior works.