HTTP协议报文头域关键字段的隐蔽通信检测模型

The Covert Communication Detection Model Based on Key Field of Header in HTTP Protocol

基于HTTP网络应用层隐蔽通信出现的信息安全威胁问题,提出针对码间序列相关性统计特征的差值距离检测算法,并与HTTP协议下隐蔽通信空间相关性检测算法相结合,利用多报文头域间关键字符差值对通信中存在隐蔽信息进行检测,建立HTTP协议报文头域关键字段隐蔽信道检测模型。通过分析表明,该模型能够实现对正常通信与隐蔽通信的有效识别。

Based on the information security threat problem of HTTP network application layer concealed communication,a difference distance detection algorithm is proposed for the inter-symbol sequence correlation statistics feature.Combined with the Spatial correlation detection algorithm for covert communication under HTTP protocol,using the key character difference between multi header domains to detect the hidden information in communication,thus,the covert communication detection model of key field in HTTP protocol header domain is established.The test results show that the efficient identification of key field and covert channel of HTTP protocol header domain is realized.