Covert channel communication detection method, device and equipment

Abstract

The invention discloses a covert channel communication detection method, device and equipment. The method comprises the following steps: acquiring an ICMP data packet; extracting the preset feature ofthe ICMP data packet, and executing feature statistics according to the preset feature to obtain an execution feature statistics to obtain a target feature vector; and detecting the target feature vector by using the detection model to determine whether an ICMP covert channel exists or not. According to the method, the detection model is used for detecting the target feature vector to determine whether the ICMP covert channel exists or not, so that covert channel communication detection based on the ICMP data message is realized, and the network security of the user host is relatively ensured. In addition, the invention further provides a covert channel communication detection device and equipment based on ICMP and a storage medium, and the beneficial effects are as described above.

Description

technical field [0001] The present application relates to the field of network communication, in particular to a method, device and equipment for detecting covert channel communication. Background technique [0002] ICMP (Internet Control Message Protocol, Internet Control Message Protocol) is a sub-protocol of the TCP / IP protocol suite, and is used to transmit control messages between IP hosts and routers. The control message refers to the message of the network itself such as whether the network is unreachable, whether the host is reachable, and whether the route is available. The current common ping and tracert both use the ICMP protocol to implement network functions, and they are typical examples of applying network protocols to daily network management. [0003] Covert channel communication based on ICMP protocol, as its name implies, is a method of using ICMP protocol for data transmission to achieve communication means. Since the ICMP protocol is a communication pr...

AI Technical Summary

Problems solved by technology

Since the ICMP protocol is a communication protocol with a low standard, and its data packets usually occupy a small amount of traffic in the network, it is often ignored by traffic analyzers and network administrators, and the current malicious controller may pass ICMP data The packet carries malicious behavior data to communicate with the user host, so as to achieve the purpose of malicious control of the user host, and it is difficult to ensure the network security of the user host

Images