| 基于C4.5的HTTP隧道检测技术研究 |
| |
| 引用本文： | 王宜菲,杨亚磊,饶孟良.基于C4.5的HTTP隧道检测技术研究[J].计算机工程与设计,2012,33(2):493-497. |
| |
| 作者姓名： | 王宜菲 杨亚磊 饶孟良 |
| |
| 作者单位： | 1. 69036部队,新疆库尔勒,841000
2. 西北工业大学计算机学院,陕西西安,710129 |
| |
| 基金项目： | 国家863高技术研究发展计划重大基金项目，"核高基"国家科技重大专项基金项目 |
| |
| 摘 要： | 针对网络恶意软件威胁日益严重等问题,研究了恶意软件常采用的通信方式——隧道技术,并提出了一种基于C4.5的HTTP隧道检测算法.该算法采用决策支持树算法C4.5提取网络流特征字段,根据特征字段生成训练数据建立HTTP隧道分类的决策树检测模型,采用该分类模型检测HTTP隧道流,为检测恶意软件提供依据.实验结果表明,与同类算法相比,该算法不依赖样本空间的分布,能准确地检测HTTP隧道流,具有良好的有效性和稳定性.
|
| 关 键 词： | 恶意软件 网络流 HTTP隧道检测 C4.5 决策树 |
Research of HTTP tunnel detecting technique based on C4.5 |
| |
| WANG Yi-fei
,
YANG Ya-lei
,
RAO Meng-liang.Research of HTTP tunnel detecting technique based on C4.5[J].Computer Engineering and Design,2012,33(2):493-497. |
| |
| Authors: | WANG Yi-fei YANG Ya-lei RAO Meng-liang |
| |
| Affiliation: | 1.Army No.69036 in Xinjiang Military Region,Korla 841000,China; 2.College of Computer,Northwestern Polytechnical University,Xi’an 710129,China) |
| |
| Abstract: | According to the more and more serious threat of malicious software,the tunnel communication is researched,which is used by malicious software.An approach that detects HTTP tunnel based on C4.5 is presented.The algorithm obtains feature fields to generate training set for building classification model using C4.5,and then combine famous address matching,the direction selection of HTTP flow to detect the http tunnel traffics.The algorithm is compared with the related algorithm.The results show the algorithm does not use the probability distribution of sample space,so it is steady and effective,which can detect the HTTP tunnel flow with high hit ratio. |
| |
| Keywords: | malicious software traffic flow HTTP tunnel detecting C4 5 decision tree |
| 本文献已被 CNKI 万方数据 等数据库收录！ |
|
