基于操作行为的隧道木马检测方法  

Tunnel Trojan Detection Method Based on Operation Behavior

作　　者：孙海涛[1] 刘胜利[1] 陈嘉勇[1] 孟磊[1] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002

出　　处：《计算机工程》2011年第20期123-126,共4页Computer Engineering

基　　金：国家"863"计划基金资助项目(2008AA01Z420)

摘　　要：木马通常利用HTTP隧道技术突破防护设备,对网络安全造成威胁。针对该问题,提出一种利用木马操作行为检测网络中HTTP隧道木马的方法。该方法通过6个统计特征描述正常的HTTP会话,采用HTTP隧道技术发现木马操作之间的差别,利用数据挖掘中C4.5决策树分类算法对2种会话进行分类。实验结果表明,该方法能检测多种已知的HTTP隧道木马。Some Trojans use HTTP tunnel to pass through a variety of network security devices,which poses a serious threat to current network security.This paper presents a new method to detect the HTTP tunneling Trojans by using operation behavior characteristics.The difference between normal HTTP session and Trojan operation session with HTTP tunneling are depicted by six statistics eigenvalues,and C4.5 decision tree classification algorithm in data mining is introduced to classify the two sessions.Experimental results show that the method can efficiently detect many known HTTP tunnel Trojans.

关 键 词：HTTP隧道 网络会话 会话特征 木马检测 C4.5决策树 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]