A method for detecting HTTP obfuscated traffic based on suspiciousness evaluation

Abstract

The invention discloses an HTTP confusion traffic detection method based on suspicious degree evaluation. First, network traffic is filtered, data streams in the form of HTTP protocol are extracted, and the integrity of protocol header information, content type identification and load data of HTTP data streams are analyzed. Type three features, use the suspiciousness function to calculate the suspiciousness of each feature, and use the weighted number of suspiciousness as the input of the judger, and the judger judges whether the data flow belongs to normal HTTP or confusing HTTP, and the suspiciousness weight exceeds the judgment threshold. If it is confused, otherwise it is judged as normal. The invention does not rely on the variable fingerprint feature of the data flow, has good adaptability, and can adapt to complex situations of different network environments.

Description

Technical field[0001]The present invention relates to network and information security techniques, and more particularly to an HTTP overflow rate detection method based on a doubt-evaluation.Background technique[0002]Traffic Confusion Techniques Use specific means to convert the data of any protocol format into specific protocols, which can be used as a privacy protection method in the network traffic data transmission process, or to counter network security mechanisms, disclosure data or C & C channel, threatens public safety. Especially HTTP confusion technology, because HTTP is widely used by the Internet, the corresponding 80-port carries a lot of necessary applications, so there is almost no firewall blocks the port, which makes HTTP confused very flood. Therefore, detecting the presence of HTTP confusion flow, preventing hazards from occurring, is a crucial link. HTTP Confused Traffic Detection Technology As a very important technology in the field of network security, it has ...

AI Technical Summary

Problems solved by technology

[0003] According to the literature search, it is found that most of the existing detection technologies are based on machine learning classification algorithms. Compared with the traditional method based on rules and patterns, this research method has made great progress, but most of the research objects Obfuscated traffic generated for a specific obfuscated software, and has a designated monitoring environment, not universal

At the same time, the machine learning training of this type of detection scheme is mostly based on limited experimental data, and the effect on relatively closed data sets is even close to 100%. However, the traffic forms in the real network environment are more abundant. Classifier, in the real network environment will produce a large number of false alarms

Images