Publication: Desarrollo de un preclasificador de contenidos basado en hashes difusos para una plataforma de intercepción legal de comunicaciones
Loading...
Identifiers
Publication date
2012-04
Defense date
2012-04-27
Authors
Advisors
Tutors
Journal Title
Journal ISSN
Volume Title
Publisher
Impact
Export
Abstract
El presente proyecto intenta dar solución a un problema que ha surgido debido al auge de internet como canal de distribución de información. Todos los usuarios que utilizan internet se están intercambiando información continuamente, pero esta información no es siempre legal. Existen usuarios que se intercambian tanto contenidos lícitos como delictivos (e.g. pornografía infantil), pero para poder detectar este contenido y poder perseguir legalmente a estos usuarios, la normativa actual sobre la intercepción legal de las comunicaciones establece que es un juez quien debe ordenar dicha intercepción e indicar el delito por el que es investigado un sospecho. Una vez que un juez autoriza la intercepción legal de las comunicaciones del sospechoso, los analistas de las fuerzas de seguridad se pueden encontrar con el problema de que el sospechoso se haya intercambiado una cantidad inmanejable de datos de toda índole, por lo que el análisis y clasificación por parte de los analistas puede llevar un tiempo y unos medios de los cuales no dispongan los cuerpos de seguridad. Por este motivo vemos la necesidad de implementar un sistema de pre-clasificación de contenidos ilícitos, para facilitar al analista el trabajo de la clasificación. Cabe destacar que debido a consideraciones legales y prácticas es el analista el último responsable sobre la calificación de los contenidos interceptados. La forma habitual para realizar la pre-clasificación de contenidos es la utilización de listas de firmas de contenidos ilegales incautados con anterioridad y calculadas mediante hashes criptográficos. Sin embargo para eludirlos basta con cambiar mínimamente el contenido. Para evitar esos posibles intentos de engañar al sistema de detección por parte de los sospechosos, el pre-clasificador está implementado mediante un sistema que permite detectar contenidos similares, Fuzzy hashing. De esta forma se intenta evitar que una pequeña modificación en el contenido haga fallar al pre-clasificador. Si el preclasificador estuviera implementado mediante hash criptográficos no podríamos detectar contenidos similares entre sí, ya que el objetivo de los hash criptográficos es encontrar ficheros idénticos. Adicionalmente también se ha considerado necesario dotar al fuzzy hashing implementado, de una clave de seguridad para el cálculo de los hash de los contenidos. De esta forma la firma generada tiene mayor seguridad ante posibles ataques por parte de los sospechosos, que se adapten a las técnicas de Fuzzy hashing. Este trabajo se enmarca dentro del proyecto de investigación Europeo ‘INDECT’ de forma que el sistema desarrollado pueda ser integrado con la plataforma de interceptación legal de datos sobre redes IP que está desarrollando la UC3M, y que está basada en la herramienta forense Xplico. ____________________________________________________________________________________________________________________
This Project tries to solve a problem arisen from increase of internet as information distribution channel. All internet users are continuously exchanging information, but this information is not always legal. There are internet users that exchange whether legal content or illicit (i.e child pornography), however in order to detect this content and legally pursue these users , current regulations about legal interception of communications state that should be a Judge who must order such interception and show the crime because a suspicious is being investigated. Once the Judge authorizes legal interception of suspicious people communications, security forces analyst can find the problem that suspicious people has exchanged an enormous quantity of data of whichever nature, therefore analysis and classification tasks to be perform by analysts can spend time and means nor available by security forces. That is the reason why we see the necessity to implement a system for pre-classification of illicit content, in order to facilitate to analyst the classification tasks. Emphasize that due to legal and useful consideration, the analyst is the final responsible about content interceptions qualification. Habitual way to perform content pre-classification is using signature list about illicit content previously confiscated and calculated by means of hashes cryptographic. However for eluding that it is enough with minimum changes in content. To avoid those possible attempt to fool the detection system by the suspicious people, pre-classification is implemented by means of a system that allow to detect similar contents, Fuzzy hashing. On this way, it tries to avoid that a small contents modification could make preclassification fail. Whether pre-classification system were be implemented by means of hash cryptographic we can’t detect similar contents, because of hash cryptographic aim is finding identical files. In addition it has been considered necessary to equipped the Fuzzy hashing with a password to calculate the hash of the contents. On this way, password generated is securer against suspicious possible attack who adapted to the Fuzzy hashing techniques. This piece of work is included on the European research project “INDECT” with the aim that developed system can be integrated in the data legal interception platform about IP networks that is developing UC3M and that it is based on forense Xplico tool.
This Project tries to solve a problem arisen from increase of internet as information distribution channel. All internet users are continuously exchanging information, but this information is not always legal. There are internet users that exchange whether legal content or illicit (i.e child pornography), however in order to detect this content and legally pursue these users , current regulations about legal interception of communications state that should be a Judge who must order such interception and show the crime because a suspicious is being investigated. Once the Judge authorizes legal interception of suspicious people communications, security forces analyst can find the problem that suspicious people has exchanged an enormous quantity of data of whichever nature, therefore analysis and classification tasks to be perform by analysts can spend time and means nor available by security forces. That is the reason why we see the necessity to implement a system for pre-classification of illicit content, in order to facilitate to analyst the classification tasks. Emphasize that due to legal and useful consideration, the analyst is the final responsible about content interceptions qualification. Habitual way to perform content pre-classification is using signature list about illicit content previously confiscated and calculated by means of hashes cryptographic. However for eluding that it is enough with minimum changes in content. To avoid those possible attempt to fool the detection system by the suspicious people, pre-classification is implemented by means of a system that allow to detect similar contents, Fuzzy hashing. On this way, it tries to avoid that a small contents modification could make preclassification fail. Whether pre-classification system were be implemented by means of hash cryptographic we can’t detect similar contents, because of hash cryptographic aim is finding identical files. In addition it has been considered necessary to equipped the Fuzzy hashing with a password to calculate the hash of the contents. On this way, password generated is securer against suspicious possible attack who adapted to the Fuzzy hashing techniques. This piece of work is included on the European research project “INDECT” with the aim that developed system can be integrated in the data legal interception platform about IP networks that is developing UC3M and that it is based on forense Xplico tool.
Description
Keywords
Internet, Gestión de contenidos, Técnicas de Fuzzy Hashing, Evaluación de contenidos