Method for detecting HTTP tunnel data based on conversation and HTTP protocol standard

Abstract

The invention belongs to the technical field of computer networks, and provides a method for detecting HTTP tunnel data based on a conversation and the HTTP protocol standard. A system captures a data packet of an HTTP port and establishes a conversation linked list according to the IP address and the port. When the data packet arrives at a detection system, firstly, the system examines and maintains the conversation linked list, a record is added if not record exists, and the record is deleted from the conversation linked list if the RST data packet or the FIN data packet exists; secondly, the system examines the content of the data packet and judges whether the conversation connection meets the standard HTTP protocol, such as a client-side command GET, a client-side command POST, a server-side response HTTP / 1.0 and a server-side response HTTP / 1.1, or not, if the conversation connection meets the standard HTTP protocol, the conversation is marked as HTTP protocol data, and if the conversation connection does not meet the standard HTTP protocol, the conversation is marked as HTTP tunnel data. By means of the method, the HTTP tunnel data can be recognized, differential service can be conducted on the HTTP tunnel data, or data which are not the HTTP protocol data can be prevented from penetrating through the HTTP port.

Description

technical field [0001] The invention belongs to the technical field of computer networks, and relates to a method for distinguishing standard HTTP protocol data and HTTP tunnel data. Background technique [0002] With the development of Internet technology, how to control intranet users' access to the Internet has become the focus of network management. Traditional network management uses ports to distinguish various network services, and controls external network access by opening or closing certain ports. WEB browsing, as the most basic Internet service, usually needs to be opened to users. It uses the HTTP protocol, and the default port is TCP80. In view of the fact that HTTP ports are generally open, various software have used HTTP tunneling technology to establish connections with the outside world. Both the HTTP protocol data and the HTTP tunnel data use the same port, so the HTTP tunnel data cannot be controlled simply by closing the port, otherwise the user will no...

AI Technical Summary

Problems solved by technology

Both HTTP protocol data and HTTP tunnel data use the same port, so the HTTP tunnel data cannot be controlled simply by closing the port, otherwise users will not be able to browse the web

Traditional port control methods have been unable to cope with HTTP tunnel penetration technology, and unauthorized access to the external network seriously threatens the security of the internal network

Images