HTTP Tunnel Trojan Detection Based on Network Behavior

摘要：

HTTP tunnel Trojans encapsulate all outgoing traffic into semantically valid HTTP requests that are then sent to the attacker. This paper presents a new method to detect the HTTP tunneling Trojans by using network behavior characteristics. In this paper, the communication processes of tunnel Trojan were divided into two stages. The difference between normal HTTP session and Trojan session with HTTP tunneling were depicted by eight statistics attributes, and statistical analysis and C4.5 decision tree classification algorithm were introduced to classify the two sessions. The experimental results showed that our method could efficiently detect most of the known HTTP Tunnel Trojans and could find some unknown HTTP Tunnel Trojans.

关键词： HTTP tunnel network behavior Trojan detection C4.5 decision tree

作者: Haitao Sun Shengli Liu Jiayong Chen Changhe Zhang

作者单位: Zhengzhou Institute of Information Science and Technology Zhengzhou, China

会议类型: 国际会议

会议名称: 2010 International Conference on Information Security and Artificial Intelligence(2010年信息安全与人工智能国际会议 ISAI 2010)

会议地点: 成都

会议语种:英文

页码: 1071-1075

在线出版日期: 2010-12-17（万方平台首次上网日期，不代表论文的发表时间）