ICMPTend: Internet Control Message Protocol Covert Tunnel Attack Intent Detector  

作　　者：Tengfei Tu Wei Yin Hua Zhang Xingyu Zeng Xiaoxiang Deng Yuchen Zhou Xu Liu 

机构地区：[1]State Key Laboratory of Networking and Switching Technology,Beijing University of Posts and Telecommunications,Beijing,100876,China [2]State Key Laboratory of Cryptology,Beijing,100878,China [3]National Computer Network Emergency Response Technical Team/Coordination Center of China,100029,China [4]Pennsylvania State University,State College,16801,USA

出　　处：《Computers, Materials & Continua》2022年第5期2315-2331,共17页计算机、材料和连续体（英文）

基　　金：This research was supported by National Natural Science Foundation of China(Grant Nos.61972048,62072051).

摘　　要：The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not easy to be discovered.Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions.In this paper,we propose an ICMP covert tunnel attack intent detection framework ICMPTend,which includes five steps:data collection,feature dictionary construction,data preprocessing,model construction,and attack intent prediction.ICMPTend can detect a variety of attack intentions,such as shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attacks.We extract features from five types of attack intent found in ICMP channels.We build a multi-dimensional dictionary of malicious features,including shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attack keywords.For the high-dimensional and independent characteristics of ICMP traffic,we use a support vector machine(SVM)as a multi-class classifier.The experimental results show that the average accuracy of ICMPTend is 92%,training ICMPTend only takes 55 s,and the prediction time is only 2 s,which can effectively identify the attack intention of ICMP.

关 键 词：Internet control message protocol support vector machine covert tunnel network analysis 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]