Research of HTTP tunnel detecting technique based on C4.5
Rao Meng-liang · Jisuanji gongcheng yu sheji · 2012
According to the more and more serious threat of malicious software,the tunnel communication is researched,which is used by malicious software.An approach that detects HTTP tunnel based on C4.5 is presented.The algorithm obtains feature fields to generate training set for building classification model using C4.5,and then combine famous address matching,the direction selection of HTTP flow to detect the http tunnel traffics.The algorithm is compared with the related algorithm.The results show the algorithm does not use the probability distribution of sample space,so it is steady and effective,which can detect the HTTP tunnel flow with high hit ratio.