超文本传输协议(Hyper Text Transfer Protocol,HTTP)隧道具有穿越防火墙和规避入侵检测系统识别的能力,给信息安全带来严重威胁。然而现阶段的HTTP隧道检测方法识别能力不足、难以应对特征复杂的HTTP隧道。文中分析了HTTP隧道数据包与...超文本传输协议(Hyper Text Transfer Protocol,HTTP)隧道具有穿越防火墙和规避入侵检测系统识别的能力,给信息安全带来严重威胁。然而现阶段的HTTP隧道检测方法识别能力不足、难以应对特征复杂的HTTP隧道。文中分析了HTTP隧道数据包与正常HTTP数据包之间的差别,针对目前HTTP隧道检测方法存在的不足,提出了一种仅需提取小部分流量数据的基于卷积神经网络的HTTP隧道检测方法。实验结果表明,基于卷积神经网络的HTTP隧道检测方法能有效识别网络中的HTTP隧道流量,检测精确率、召回率、F1分数均达到99%以上,且不需要人工选择大量的专家特征,对网络流量监管有重要意义。展开更多
To understand website complexity deeply, a web page complexity measurement system is developed. The system measures the complexity of a web page at two levels： transport-level and content-level, using a packet trace-...To understand website complexity deeply, a web page complexity measurement system is developed. The system measures the complexity of a web page at two levels： transport-level and content-level, using a packet trace-based approach rather than server or client logs. Packet traces surpass others in the amount of information contained. Quantitative analyses show that different categories of web pages have different complexity characteristics. Experimental results show that a news web page usually loads much more elements at more accessing levels from much more web servers within diverse administrative domains over much more concurrent transmission control protocol （TCP） flows. About more than half of education pages each only involve a few logical servers, where most of elements of a web page are fetched only from one or two logical servers. The number of content types for web game traffic after login is usually least. The system can help web page designers to design more efficient web pages, and help researchers or Internet users to know communication details.展开更多
文摘超文本传输协议(Hyper Text Transfer Protocol,HTTP)隧道具有穿越防火墙和规避入侵检测系统识别的能力,给信息安全带来严重威胁。然而现阶段的HTTP隧道检测方法识别能力不足、难以应对特征复杂的HTTP隧道。文中分析了HTTP隧道数据包与正常HTTP数据包之间的差别,针对目前HTTP隧道检测方法存在的不足,提出了一种仅需提取小部分流量数据的基于卷积神经网络的HTTP隧道检测方法。实验结果表明,基于卷积神经网络的HTTP隧道检测方法能有效识别网络中的HTTP隧道流量,检测精确率、召回率、F1分数均达到99%以上,且不需要人工选择大量的专家特征,对网络流量监管有重要意义。
基金supported by the Open Research Program of the Key Laboratory of Computer Network and Information Integration(Southeast University),Ministry of Education(K93-9-2014-04B)the National Natural Science Foundation of China(61170322,61572263,61302157)
文摘To understand website complexity deeply, a web page complexity measurement system is developed. The system measures the complexity of a web page at two levels： transport-level and content-level, using a packet trace-based approach rather than server or client logs. Packet traces surpass others in the amount of information contained. Quantitative analyses show that different categories of web pages have different complexity characteristics. Experimental results show that a news web page usually loads much more elements at more accessing levels from much more web servers within diverse administrative domains over much more concurrent transmission control protocol （TCP） flows. About more than half of education pages each only involve a few logical servers, where most of elements of a web page are fetched only from one or two logical servers. The number of content types for web game traffic after login is usually least. The system can help web page designers to design more efficient web pages, and help researchers or Internet users to know communication details.
