基于Markov模型的HTTP参数排序隐蔽信道检测方法

doi:10.19678/j.issn.1000-3428.0053783

计算机工程 ›› 2020, Vol. 46 ›› Issue (2): 154-158,169. doi: 10.19678/j.issn.1000-3428.0053783

基于Markov模型的HTTP参数排序隐蔽信道检测方法

沈国良¹, 翟江涛¹, 戴跃伟²

1. 江苏科技大学电子信息学院, 江苏镇江 212003;
2. 南京信息工程大学计算机与软件学院, 南京 210000

收稿日期:2019-01-22 修回日期:2019-03-21 发布日期:2019-04-22
作者简介:沈国良(1994-),男,硕士研究生,主研方向为多媒体与信息安全;翟江涛(通信作者),副教授;戴跃伟,教授、博士生导师。
基金资助:
国家自然科学基金（61702235，61472188，61602247，U1636117）；江苏省自然科学基金（BK20150472，BK20160840）。

HTTP Parameter Sorting Covert Channel Detection Method Based on Markov Model

SHEN Guoliang¹, ZHAI Jiangtao¹, DAI Yuewei²

1. School of Electronics and Information, Jiangsu University of Science and Technology, Zhenjiang, Jiangsu 212003, China;
2. School of Computer and Software, Nanjing University of Information Science and Technology, Nanjing 210000, China

Received:2019-01-22 Revised:2019-03-21 Published:2019-04-22

摘要/Abstract

摘要： 网络隐蔽信道是利用网络协议中的保留、可选或未定义等字段在网络不同主机间建立秘密消息传输的通信信道，其中HTTP协议作为万维网上最常用的协议之一，是网络隐蔽信道的良好载体。为有效检测基于HTTP协议的隐蔽信道，提出一种基于Markov模型的隐蔽信道检测方法。以Host、Connection、Accept和User-Agent为关键字，建立数据包的Markov模型并计算其状态转移概率矩阵，利用待测数据包与正常数据包2个概率矩阵之间的相对熵，判别是否存在隐蔽信道通信。实验结果表明，当隐蔽信道中的异常数据超过70%时，该方法检测率可达97%以上。

关键词: HTTP协议, 隐蔽信道检测, Markov模型, 相对熵, 检测率

Abstract: The network covert channel is a communication channel that establishes secret message transmission between different hosts on the network by utilizing reserved,optional or undefined fields in the network protocols.HTTP protocol,as one of the most commonly used protocols on the World Wide Web,becomes a good carrier of network covert channels.In order to effectively detect the HTTP protocol-based covert channel,this paper proposes a covert channel detection method based on Markov model.Taking Host,Connection,Accept and User-Agent as keywords,this method establishes the Markov model of data packet and calculates the state transition probability matrix of this model.The relative entropy between the data packet to be tested and the normal data packet is used to determine whether the covert channel exists or not.Experimental results show that when the abnormal data in the covert channel exceeds 70%,the detection rate of this method can reach more than 97%.

Key words: HTTP protocol, covert channel detection, Markov model, relative entropy, detection rate

中图分类号:

TP393

沈国良, 翟江涛, 戴跃伟. 基于Markov模型的HTTP参数排序隐蔽信道检测方法[J]. 计算机工程, 2020, 46(2): 154-158,169.

SHEN Guoliang, ZHAI Jiangtao, DAI Yuewei. HTTP Parameter Sorting Covert Channel Detection Method Based on Markov Model[J]. Computer Engineering, 2020, 46(2): 154-158,169.

https://www.ecice06.com/CN/Y2020/V46/I2/154

图/表 8

20200218142429

20200218142508

20200218142512

20200218142515

20200218142519

20200218142523

20200218142526

20200218142529

参考文献

[1] GEISLER D,MAZURCZYK W,KELLER J.Towards utilization of covert channels as a green networking technique[C]//Proceedings of the 13th International Conference on Availability,Reliability and Security.New York,USA:ACM Press,2018:1-10.
[2] LIU Fang,LI Dongdong,ZHAO Yuntao,et al.The covert communication detection model based on key field of header in HTTP protocol[J].Fire Control and Command Control,2018,43(11):40-45.(in Chinese) 刘芳,李东东,赵运弢,等.HTTP协议报文头域关键字段的隐蔽通信检测模型[J].火力与指挥控制,2018,43(11):40-45.
[3] ZHANG Lihua.Research on Anti-interference Technology of covert channel in time network[D].Nanjing:Nanjing University of Science and Technology,2017.(in Chinese) 张立华.时间式网络隐蔽信道抗扰技术研究[D].南京:南京理工大学,2017.
[4] KOGOS K G,SELIVERSTOVA E I,EPISHKINA A V.Review of covert channels over HTTP:communication and countermeasures[C]//Proceedings of 2017 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering.Washington D.C.,USA:IEEE Press,2017:459-462.
[5] LIANG Jun.The improvement and optimization of the network storage covert channel test simulation[J].Computer Simulation,2017,34(2):406-409.(in Chinese) 梁竣.网络存储隐蔽信道检测的改进与优化仿真[J].计算机仿真,2017,34(2):406-409.
[6] LIU Zhengyi,SONG Tian.Covert sequence channel based on HTTP/2 protocol[J].Journal of Computer Research and Development,2018,55(6):1157-1166.
[7] JOHNSON M,LUTZ P,JOHNSON D.Covert channel using man-in-the-middle over HTTPS[C]//Proceedings of 2016 International Conference on Computational Science and Computational Intelligence.Washington D.C.,USA:IEEE Press,2016:917-922.
[8] WANG Fei.Research on design and detection technology of covert channels based on WEB[D].Hefei:University of Science and Technology of China,2014.(in Chinese) 王飞.基于WEB的隐蔽信道设计与检测技术研究[D].合肥:中国科学技术大学,2014.
[9] ZHANG Xiaosing,LIANG Chen,ZHANG Quanxin,et al.Building covert timing channels by packet rearrangement over mobile networks[J].Information Sciences,2018,445:66-78.

[10] BELOZUBOVA A,EPISHKINA A,KOGOS K.Random delays to limit on/off covert channel[C]//Proceedings of the 18th Mediterranean Electrotechnical Conference.Washington D.C.,USA:IEEE Press,2016:1-5.
[11] QI Wen,DING Wanfu,WANG Xinyu,et al.Construction and mitigation of user-behavior-based covert channels on smartphones[J].IEEE Transactions on Mobile Computing,2017,17(1):44-57.
[12] SHEN Yao,HUANG Liusheng,WANG Fei,et al.LiHB:lost in HTTP behaviors-a behavior-based covert channel in HTTP[C]//Proceedings of the 3rd ACM Workshop on Information Hiding and Multimedia Security.New York,USA:ACM Press,2015:55-64.
[13] QIAN Yuwen,SONG Huaju,ZHAO Bangxin,et al.Study on the detection algorithm of covert network behavior channel based on corrected entropy[J].Systems Engineering and Electronics,2013,35(6):1312-1317.(in Chinese) 钱玉文,宋华菊,赵邦信,等.基于校正熵的网络行为隐蔽信道的检测算法[J].系统工程与电子技术,2013,35(6):1312-1317.
[14] REZAEI F,HEMPEL M,SHARIF H.Towards a reliable detection of covert timing channels over real-time network traffic[J].IEEE Transactions on Dependable and Secure Computing,2017,14(3):249-264.
[15] QIAN Yuwen,SONG Huaju,SONG Chao,et al.Network covert channel detection with cluster based on hierarchy and density[J].Procedia Engineering,2012,29:4175-4180.
[16] SAYADI S,ABBES T,BOUHOULA A.Detection of covert channels over ICMP protocol[C]//Proceedings of 2017 IEEE/ACS International Conference on Computer Systems and Applications.Washington D.C.,USA:IEEE Press,2017:1247-1252.
[17] SUR A,NAIR A S,KUMAR A,et al.Steganalysis of network packet length based data hiding[J].Circuits,Systems,and Signal Processing,2013,32(3):1239-1256.
[18] CABUK S,BRODLEY C E,SHIELDS C.IP covert channel detection[J].ACM Transactions on Information and System Security,2009,12(4):1-29.
[19] LI Meng.Research on several typical network steganalysis algorithms[D].Zhenjiang:Jiangsu University of Science and Technology,2019.(in Chinese) 李萌.几种典型网络隐写检测算法研究[D].镇江:江苏科技大学,2019.
[20] MA Wenyan.Several new application layer covert channels on the HTTP protocol[J].Computer CD Software and Applications,2014(15):179-180.(in Chinese) 马文岩.HTTP协议上几种新的应用层隐蔽通道[J].计算机光盘软件与应用,2014(15):179-180.
[21] HAN Chunhao.Research and application of network traffic classification[D].Beijing:Beijing University of Chemical Technology,2017.(in Chinese) 韩春昊.网络流量分类研究与应用[D].北京:北京化工大学,2017.

选择文件类型/文献管理软件名称

选择包含的内容

基于Markov模型的HTTP参数排序隐蔽信道检测方法

HTTP Parameter Sorting Covert Channel Detection Method Based on Markov Model

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	韩磊, 於志勇, 朱伟平, 於志文. 面向车辆目的地推测的时空搜索优化[J]. 计算机工程, 2020, 46(2): 28-34.
[2]	马礼,张涛,马东超,傅颖勋. 基于Markov模型的接入网络选择算法[J]. 计算机工程, 2019, 45(5): 105-109,115.
[3]	杨晨晨,马春梅,朱金奇. 基于智能手机的跌倒行为识别算法研究[J]. 计算机工程, 2019, 45(2): 178-183.
[4]	谭阳红, 张婧, 李肖. 基于复杂网络理论的电网节点重要度评估[J]. 计算机工程, 2019, 45(11): 281-286,297.
[5]	兰涯雯, 李强, 邓淑桃, 黄诗雅. 基于多属性关联决策的WSN故障检测方法[J]. 计算机工程, 2019, 45(10): 84-89.
[6]	赵英,韩春昊. 马尔科夫模型在网络流量分类中的应用与研究[J]. 计算机工程, 2018, 44(5): 291-295.
[7]	马丽丽,王战,陈金广. 低检测率条件下改进的势均衡多目标多伯努利算法[J]. 计算机工程, 2016, 42(7): 273-276,286.
[8]	张妍,傅秀芬. 基于三目标搜索的测试用例集约简方法[J]. 计算机工程, 2016, 42(3): 84-88.
[9]	袁健,王涛. 基于聚类分析的网络存储隐蔽信道检测算法[J]. 计算机工程, 2015, 41(9): 168-173.
[10]	丁石磊,郑紫微,杨任尔. 一种基于移动终端的最佳匹配隐写系统[J]. 计算机工程, 2015, 41(3): 303-305,311.
[11]	牟永敏，李慧丽. 基于函数调用路径的测试用例优先级排序[J]. 计算机工程, 2014, 40(7): 242-246,253.
[12]	董哲，伊鹏，扈红超. 基于动态有噪网络的增量社团发现算法[J]. 计算机工程, 2014, 40(2): 166-170.
[13]	徐守坤，王薇，乐光学. IWO-Kohonen聚类算法在IDS中的应用[J]. 计算机工程, 2014, 40(1): 139-143.
[14]	邢鸿雁，张倩生，张纯桂. Vague集理论及其在国画类别区分中的应用[J]. 计算机工程, 2013, 39(12): 171-175,180.
[15]	谢怀忠, 易辉跃, 胡艳军, 胡宏林. 基于门限动态调整的最优协作检测方法[J]. 计算机工程, 2012, 38(7): 83-86.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于Markov模型的HTTP参数排序隐蔽信道检测方法

HTTP Parameter Sorting Covert Channel Detection Method Based on Markov Model

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献

相关文章 15

编辑推荐

Metrics

本文评价