ICMP covert channel detection method based on random forest

Abstract

The invention relates to the field of machine learning algorithms and covert channel detection, and aims to provide an ICMP covert channel detection method based on a random forest machine learning algorithm. According to the technology, firstly, data packets of inter-network communication are captured, basic information (a source IP address, a destination IP address and the like) related to the data packets in the data packets is extracted, the information is classified, an ICMP message flow is formed according to the information, and characteristics are extracted from the corresponding ICMPmessage flow by utilizing a specific rule of the method; the method comprises the following steps: obtaining the characteristics of the ICMP message communication data flow between a source IP addressand a destination IP address, training the characteristics by using a random forest-based machine learning method, and finally obtaining a classifier for detecting an ICMP covert channel. When the method is used for ICMP covert channel detection, the calculation cost and the time cost are low, the generated ICMP flow features are strong in pertinence and high in reliability, and the ICMP covert channel can be effectively detected.

Description

technical field [0001] The present invention relates to network flow monitoring technology, and aims to detect ICMP data packets by using the characteristics of ICMP flow and random forest algorithm. The core is to extract features from captured normal ICMP messages and abnormal ICMP messages, and generate Classification models generated by rules and machine learning methods to identify ICMP covert channel communication behavior. Background technique [0002] With the rapid development of computer network technology, more and more advanced technologies are correspondingly born. At the same time, the emergence of information security problems is also serious. The hidden tunnel problem is a serious information security problem at present. The hidden tunnel is a method based on the loopholes of the network protocol to use the redundancy of various network protocols to secretly transmit data and attack the network. Although intrusion detection systems, firewalls and other secur...

AI Technical Summary

Problems solved by technology

[0009] "A random forest-based ICMP covert channel detection method" is an invention proposed during the detection process of data packets containing ICMP messages in network traffic. One purpose of the present invention is to detect and calculate existing ICMP covert channels Complexity, low detection accuracy, excessive resource consumption and other shortcomings, a ICMP covert channel detection method based on random forest classification is proposed

Images