HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

HTTP cookie covert channel is a communication method that encodes malicious information in fields to escape regulatory audits. It difficult detect this kind of according the content because are mainly encoded custom modes. To effectively identify channel, paper proposes detection based on interaction features session flow. First, we split flow into fine-grained “interaction process” subflows comprehensively describe process cookie. Then, compare and analyze differences between channels normal communications process, design three types 7-dimensional features, build model combined with machine learning algorithm. Experimental results show our can channels, rate reach 99%. We also prove has advantages stability time performance compared existing methods through experiment analysis. In addition, certain practicability simulation environment imbalanced data.