Identification of Network Application Behaviors Hiding in HTTP Tunnels. Issue 1 (2nd January 2021)

• Record Type: Journal Article
• Authors: Bai, Huiwen; Liu, Guangjie; Liu, Weiwei; Zhai, Jiangtao; Yang, Luhui; Dai, Yuewei
• Is Part Of: IETE technical review. Volume 38:Issue 1(2021)
• Page Start: 112
• Page End: 129
• Publication Date: 2021-01-02
• Subjects: HTTP tunnels -- network application behaviors -- spatial–temporal features -- machine learning algorithms -- Decision Tree -- flow fragments size; Telecommunication -- Periodicals; Electronics -- Periodicals; Electronics; Telecommunication; Periodicals; 621.38
• DOI: 10.1080/02564602.2020.1780960
• Languages: English
• ISSNs: 0256-4602

Abstract

Abstract : HTTP tunnels almost obscure the original contents and behaviors of network applications, which makes it challenging for the network management and cybersecurity equipment to identify the hidden network application behaviors. Many efficient detection schemes have been exploited for network application identification in prior works. However, the following "Last Mile" problem, the application behavior identification hidden in HTTP tunnels, remains a significant challenge. In this paper, the typical network application behaviors are firstly summarized and the discriminative spatial–temporal features are selected by information gain and information gain ratio analysis. The feature extraction is developed on flow fragments instead of a whole HTTP flow. Experiments are conducted to verify the effectiveness of the selected features and compare the performance of three popular machine learning (ML) algorithms, namely Decision Tree, Random Forest, and Naïve Bayes. The implementation parameter suggestion for Decision Tree is also given according to a series of experiments on different algorithm parameters and flow fragmenting sizes with the compositive computation and accuracy considerations.