Method using multi-dimensional feature vectors to detect IP ID covert channel

Abstract

The invention discloses a method using multi-dimensional feature vectors to detect an IP ID covert channel. The method comprises the following steps of the feature extracting step 1 of respectively and continuously capturing N IP data packets for normal and abnormal training samples, extracting information of an ID domain of the head of an IP, acquiring the ID difference value of delta id1, delta id2,..., delta idn-1 between adjacent data packets, and carrying out statistics on a mean value E, a standard deviation D and an entropy of the id1, delta id2,..., delta idn-1 to obtain three-dimensional feature vectors, the step 2 of carrying out training on an SVM classifier, repeating the step 1 to obtain a three-dimensional feature vector set of the normal training samples and a three-dimensional feature vector set of the abnormal training samples, and carrying out training on the SVM classifier to obtain a classifying detecting model, and the step 3 of classifying the feature vectors of a channel to be detected through the SVM classifier according to the trained and obtained classifying model. The method is high in detecting efficiency, uses multi-dimensional statistic features as classifying data and improves the detection accuracy.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for detecting IP ID hidden channels by using multidimensional feature vectors. Background technique [0002] Information concealment is a new information security technology, which has developed rapidly in recent years and can be widely used in the fields of digital information copyright protection, authentication, and concealed transmission of confidential information. Information hiding technology is to use the redundancy of carrier information to embed concealed information into ordinary information, and send out secret information through the transmission of ordinary information. Information hiding can penetrate network security facilities such as access control, firewall and intrusion detection, and implement hidden communication that is not easy to be detected. [0003] Traditional information hiding mostly uses text, audio, and images as ...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to provide a method for detecting IP ID covert channels using multi-dimensional feature vectors, which solves the problems of low detection efficiency and poor practicability of existing detection algorithms, and can realize IP-based covert communication based on IP protocol. Efficient detection of hidden channels in

Images