HTTP tunnel detection method based on decision tree classification algorithm

Abstract

The invention discloses a HTTP (Hyper Text Transport Protocol) tunnel detection method based on decision tree classification algorithm, used for solving the technical problem of poor stability of a conventional tunnel detection method based on the transport layer packet statistic characteristic analysis. In the technical scheme of the invention, an HTTP data stream and a tunnel data stream are used to train a decision tree classification model, with lower requirement on quantity of training sets than a statistic fingerprint method; secondly, compared with the statistic fingerprint method in which only two flow characteristics can be utilized, the decision tree classification method can use more characteristics to train the model, therefore, obtained classification rules are more precise and stable; the process to train the model is relatively simple, does not involve image fingerprint consumes less internal storage; finally, the judgment of the decision tree classification method is made according to attributes on a plurality of branch nodes without depending on one specific critical value, which achieving better stability.

Description

technical field [0001] The invention relates to an HTTP tunnel detection method, in particular to an HTTP tunnel detection method based on a decision tree classification algorithm. Background technique [0002] The appearance of HTTP tunnel facilitates users to use the network and breaks through many network access restrictions. But it also provides hackers with powerful tools to implement network attacks. The current popular Trojan horse technology basically uses tunneling technology to penetrate the user's security protection facilities to achieve the purpose of stealing the user's private information. Therefore, HTTP tunnel detection technology is an important network information security technology. The current HTTP tunnel detection technologies mainly include: signature-based detection, protocol-based detection, and behavior-based detection. With the continuous development of HTTP tunneling technology, existing detection technologies are increasingly unable to meet a...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the deficiencies of poor stability of the existing tunnel detection method based on statistical feature analysis of transport layer data packets, the present invention provides a HTTP tunnel detection method based on decision tree classification algorithm, using HTTP data flow and tunnel data flow to classify decision tree The model is trained, and more features are used to train the model. The training process of the model is relatively simple, does not involve image fingerprints, consumes less memory, and judges based on the attributes of multiple branch nodes instead of relying on a specific Critical value, which can realize effective fusion of packet features and flow features, and improve detection stability

Images