HTTP协议报文头域关键字段的隐蔽通信检测模型  

The Covert Communication Detection Model Based on Key Field of Header in HTTP Protocol

作　　者：刘芳[1] 李东东 赵运弢[1] 冯永新[1] LIU Fang;LI Dong-dong;ZHAO Yun-tao;FENG Yong-xin(School of Information Science and Engineering,Shenyang Ligong University,Shenyang 110159,China)

机构地区：[1]沈阳理工大学信息科学与工程学院,沈阳110159

出　　处：《火力与指挥控制》2018年第11期38-43,共6页Fire Control & Command Control

基　　金：中国博士后面上基金(2016M590234);辽宁省教育厅基金资助项目(LG201611)

摘　　要：基于HTTP网络应用层隐蔽通信出现的信息安全威胁问题,提出针对码间序列相关性统计特征的差值距离检测算法,并与HTTP协议下隐蔽通信空间相关性检测算法相结合,利用多报文头域间关键字符差值对通信中存在隐蔽信息进行检测,建立HTTP协议报文头域关键字段隐蔽信道检测模型。通过分析表明,该模型能够实现对正常通信与隐蔽通信的有效识别。Based on the information security threat problem of HTTP network application layer concealed communication,a difference distance detection algorithm is proposed for the inter-symbol sequence correlation statistics feature.Combined with the Spatial correlation detection algorithm for covert communication under HTTP protocol,using the key character difference between multi header domains to detect the hidden information in communication,thus,the covert communication detection model of key field in HTTP protocol header domain is established.The test results show that the efficient identification of key field and covert channel of HTTP protocol header domain is realized.

关 键 词：HTTP 应用层 隐蔽信道 相关性 

分 类 号：TN91[电子电信—通信与信息系统] TP393[电子电信—信息与通信工程]