一种基于自动特征工程与压缩感知的网络隧道检测方法

利用网络隧道进行攻击、窃密等成为近年来网络安全领域的热点问题。如何提高大规模网络隧道检测分析时带来的识别精度低的问题亟需解决。针对基于DNS、HTTP协议的主流隧道检测问题，提出一种基于自动特征工程与压缩感知相结合的网络隧道检测方法。通过自动特征工程挖掘出更深层次的网络隧道特征，同时通过压缩感知算法在不损失高维特征精度的基础上实现降维，提高计算效率。在大规模真实数据集上实验结果表明，DNS隧道检测的F-measure值能达到95%，HTTP隧道检测的F-measure值能达到82%以上。

Network Tunnel Detection Method Based on

 Using network tunnel to attack and steal has become a hot issue in the field of network security in recent years. How to improve the recognition accuracy caused by large-scale network tunnel detection and analysis is needed to be solved. Aiming at the problem of mainstream tunnel detection based on DNS and HTTP protocols, a network tunnel detection method based on automatic feature engineering and compressed sensing is proposed. Through the automatic feature engineering, the deeper network tunnel features are mined. The dimensionality is reduced and the computational efficiency is improved by the compressed sensing algorithm without losing the high-dimensional feature precision. The experimental results on large-scale real data sets show that the F-measure value of DNS tunnel detection can reach 95%, and the F-measure value of HTTP tunnel detection can reach more than 82%.