article · 2023

Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features

Cited by 0Abstract and details only

Abstract

Covert tunnel is gradually used in threat attacks, such as remote control and data theft. In this paper, we propose a baseline feature-based malicious traffic detection method for Internet Control Message Protocol (ICMP) covert tunnel. We first analyze the packets involved in benign ICMP traffic and ICMP covert tunnel, and determine five features that show better ability to differentiate benign ICMP traffic and ICMP covert tunnel, including the average length of packet payloads, the frequency of packets, the session duration, the ratio of request and reply, and the entropy value of payload. Then, we employ a variety of machine learning models to build binary classifiers for the detection of ICMP covert tunnel. A set of experimental results show that the best detection precision, recall and Fl value of the proposed method are as high as 99.51%, 99% and 99.48%, respectively. Meanwhile, the proposed method has millisecond traffic parsing and detection analysis capabilities, which can be applied to the detection of ICMP covert tunnel in real-world scenarios.

Cite this paper

APA 7

Duan, H., & Wang, B. (2023). Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features. https://doi.org/10.1109/icpads60453.2023.00298

MLA 9

Duan, Haiying, and Baohui Wang. “Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features.” vol. 18, 2023, pp. 2210–18, https://doi.org/10.1109/icpads60453.2023.00298.

Chicago

Duan, Haiying, and Baohui Wang. 2023. “Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features.” https://doi.org/10.1109/icpads60453.2023.00298.

Harvard

Duan, H. and Wang, B. (2023) ‘Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features’. Available at: https://doi.org/10.1109/icpads60453.2023.00298.

BibTeX

@article{duan2023detection,
  title = {{Detection of Covert Tunnel over Internet Control Message Protocol Based on Baseline Features}},
  author = {Duan, Haiying and Wang, Baohui},
  volume = {18},
  pages = {2210--2218},
  year = {2023},
  doi = {10.1109/icpads60453.2023.00298}
}

Made from the index record. Check names, capitalisation and page numbers against the paper. Need another style? AI for Research has over 10,000.