An encrypted Trojan horse detection method for https covert tunnel

Abstract

The invention relates to the technical field of encrypted Trojan horse detection for HTTPS hidden tunnels, and particularly relates to an HTTPS covert tunnel-oriented encrypted Trojan detection method, which comprises the following steps: firstly, analyzing Trojan sessions from the perspective of time sequence, finding that a single Trojan session has the characteristic of being capable of being segmented into small session flows for multiple times, and proposing a method for segmenting interactive sessions in sequence by combining a time slice algorithm; Then further analyzing the small session process one by one; finding an application data interaction sequence in the heartbeat data packet interference session of the Trojan; filtering heartbeat data packets in each time cluster by usinga frequent vector mining algorithm; and finally, distinguishing the Trojan traffic and the normal conversation are distinguished by using Naive Bayes, so that identification of Trojan and normal communication is realized on the premise of being irrelevant to a protocol, the command control behavior of the Trojan can be effectively detected, the obtained data can represent the characteristics of the operation behavior of the Trojan, and the practicability is relatively good.

Description

technical field [0001] The invention relates to the technical field of encrypted Trojan horse detection for HTTPS hidden tunnels, in particular to an encrypted Trojan horse detection method for HTTPS hidden tunnels. Background technique [0002] Trojan horses are mainly used for host control and information theft. Usually, they will not damage the user system, nor will they reproduce themselves, and have high concealment. In recent years, more and more Trojan horse programs use tunneling technology to improve their penetration and use encryption technology to resist DPI detection, which brings new challenges to the identification of Trojan horse communication traffic. No matter how the Trojan modifies the features in the host to avoid host-side detection, or encrypts the payload with a complex encryption algorithm, the interaction process will not change, and the controlled end needs to accept commands from the control end and give feedback. Therefore, the study of encrypte...

AI Technical Summary

Problems solved by technology

[0013] Trojan horse programs involve huge economic interests or military purposes, and few organizations or institutions will disclose samples of Trojan horse tools, so it is difficult to obtain new sample traffic during the research process

Moreover, due to the complexity of the real network environment, the features selected by the detection algorithm are too dependent on the specific environment, and the features learned through research are not ideal in actual deployment.

Images