基于SVM的Telnet隐蔽信道检测  

Detection of Telnet Covert Channel based on SVM

作　　者：吴传伟[1] 孙瑞[1] 罗敏[1] 

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2012年第9期97-98,101,共3页Information Security and Communications Privacy

摘　　要：基于Telnet的隐蔽信道将隐匿的消息直接附加在Telnet的网络数据中,并发送至远程"服务器"。由于键盘操作具有任意性,检测这种信道比较困难。通过分析Telnet隐蔽信道技术,提出针对该隐蔽信道的检测方法。检测方法使用了一分类支持向量机(SVM),抓取用户正常操作的网络数据包作为检测样本,并利用样本数据间的时间间隔构造检测向量。试验表明,利用这种方法对基于Telnet的隐蔽信道进行检测,检测率达到100%,且虚警率较低。The covert channel based on Telnet attaches the hidden message to the telnet packet and sends it to the ＂remote server＂ , and this channel is very difficult to be detected because of the arbitrary keyboard operation. This paper analyzes the covert channel technologies based on Telnet, and proposes a detection method for the covert channel. The detection method uses one-class support vector machine（SVM）, and by capturing the user＇s normal operation of the network packets as the template and making use of the time interval between samples, constructs the detection vector. Experiment indicates that, with this method, the detection rate for the covert channel based on telnet could reach 100%, while the false detection rate is fairly low.

关 键 词：隐蔽信道 TELNET 一分类支持向量机 训练集 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]