基于C4.5的HTTP隧道检测技术研究  

Research of HTTP tunnel detecting technique based on C4.5

作　　者：王宜菲 杨亚磊[2] 饶孟良[2] 

机构地区：[1]69036部队 [2]西北工业大学计算机学院

出　　处：《计算机工程与设计》2012年第2期493-497,共5页Computer Engineering and Design

基　　金：国家863高技术研究发展计划重大基金项目(2009AA010308);"核高基"国家科技重大专项基金项目(2009ZX01043-002-001)

摘　　要：针对网络恶意软件威胁日益严重等问题,研究了恶意软件常采用的通信方式———隧道技术,并提出了一种基于C4.5的HTTP隧道检测算法。该算法采用决策支持树算法C4.5提取网络流特征字段,根据特征字段生成训练数据建立HTTP隧道分类的决策树检测模型,采用该分类模型检测HTTP隧道流,为检测恶意软件提供依据。实验结果表明,与同类算法相比,该算法不依赖样本空间的分布,能准确地检测HTTP隧道流,具有良好的有效性和稳定性。According to the more and more serious threat of malicious software,the tunnel communication is researched,which is used by malicious software.An approach that detects HTTP tunnel based on C4.5 is presented.The algorithm obtains feature fields to generate training set for building classification model using C4.5,and then combine famous address matching,the direction selection of HTTP flow to detect the http tunnel traffics.The algorithm is compared with the related algorithm.The results show the algorithm does not use the probability distribution of sample space,so it is steady and effective,which can detect the HTTP tunnel flow with high hit ratio.

关 键 词：恶意软件 网络流 HTTP隧道检测 C4.5 决策树 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]