Two-stage park network ssh reverse tunnel detection method and system

CN116506209BActive Publication Date: 2026-07-07BEIHANG UNIV
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
BEIHANG UNIV
Filing Date
2023-05-17
Publication Date
2026-07-07

AI Technical Summary

Technical Problem

Existing SSH reverse tunnel detection methods suffer from severe false negatives and easily circumvented features, resulting in insufficient detection accuracy and generalization ability, and failing to effectively identify malicious traffic in campus networks.

Method used

A two-stage detection method is adopted. First, traffic is filtered by rule matching. Then, the traffic is visualized using a deep learning CNN model. The trained model is used for classification. The combination of rule matching and deep learning methods improves detection accuracy and generalization ability.

Benefits of technology

It enables fast and accurate detection of SSH reverse tunnels, improving detection speed and accuracy, enhancing the model's generalization ability, and effectively identifying malicious traffic in the campus network.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN116506209B_ABST
    Figure CN116506209B_ABST
Patent Text Reader

Abstract

The present application relates to a kind of two-stage park network SSH reverse tunnel detection method and system, its method includes: S1: the original traffic collected is divided according to four tuples: {source ip, destination ip, source port number, destination port number}, and the original traffic with same four tuples is regarded as a flow;S2: one-stage SSH reverse tunnel detection based on rule matching, whether the flow contains SSH reverse tunnel is detected;S3: two-stage SSH reverse tunnel detection based on deep learning, after the flow is imaged, classification task is carried out using trained CNN model, whether the flow contains SSH reverse tunnel is judged;S4: the condition of flow containing SSH reverse tunnel obtained in step S2 and S3 is summarized, and detection result is output.The method provided by the present application can quickly and accurately detect the SSH reverse tunnel existing in park network.
Need to check novelty before this filing date? Find Prior Art