Abstract: Some Trojans use HTTP tunnel to pass through a variety of network security devices, which poses a serious threat to current network security. This paper presents a new method to detect the HTTP tunneling Trojans by using operation behavior characteristics. The difference between normal HTTP session and Trojan operation session with HTTP tunneling are depicted by six statistics eigenvalues, and C4.5 decision tree classification algorithm in data mining is introduced to classify the two sessions. Experimental results show that the method can efficiently detect many known HTTP tunnel Trojans.

Key words: HTTP tunnel, network session, session characteristic, Trojan detection, C4.5 decision tree

摘要： 木马通常利用HTTP隧道技术突破防护设备，对网络安全造成威胁。针对该问题，提出一种利用木马操作行为检测网络中HTTP隧道木马的方法。该方法通过6个统计特征描述正常的HTTP会话，采用HTTP隧道技术发现木马操作之间的差别，利用数据挖掘中C4.5决策树分类算法对2种会话进行分类。实验结果表明，该方法能检测多种已知的HTTP隧道木马。

关键词: HTTP隧道, 网络会话, 会话特征, 木马检测, C4.5决策树

CLC Number: 

• TP393.08