HTTP tunnel Trojan horse detection method based on deep learning

Abstract

The invention relates to the technical field of HTTP tunnel Trojan horse detection based on communication flow analysis, in particular to an HTTP tunnel Trojan horse detection method based on deep learning. The method comprises the steps: classifying the captured data packets according to a quintuple to form a TCP session linked list; extracting a load byte of each TCP package in the TCP session linked list, and converting the first 1024 bytes into an image as the input of a deep learning model; training a model and detecting suspected Trojan horses. According to the Trojan horse detection method, the deep learning model is established, and the network communication traffic generated by the HTTP tunnel Trojan and the normal application program is learned; the characteristics of the HTTP tunnel Trojan traffic are automatically extracted, and the effective detection of the HTTP tunnel Trojan traffic in the network is realized, so that the HTTP tunnel Trojan traffic hidden in a local areanetwork can be timely detected, and the safety of the local area network is protected.

Description

technical field [0001] The invention relates to the technical field of HTTP tunnel Trojan horse detection based on communication flow analysis, in particular to a deep learning-based HTTP tunnel Trojan horse detection method. Background technique [0002] With the popularization of the Internet in various fields of human society, the Internet has become a medium for transmitting various important information, and network leakage incidents occur from time to time, and attackers usually use Trojan horses to steal sensitive information. At the same time, Trojan programs use various methods to attempt to evade the detection of security software. With the advancement of various intrusion detection technologies, the Trojan anti-detection technology is also constantly developing, especially the use of tunnel technology, which makes the Trojan horse communication highly concealed and more difficult to be detected by traditional intrusion detection systems. Therefore, the detection ...

AI Technical Summary

Problems solved by technology

However, none of the above methods can fully and accurately describe the characteristics of various fields, and the information of the rest of the load is not fully utilized. There is still a high rate of false positives or false positives, and they do not have good versatility.

Images