Tengfei Tu1,2, Wei Yin3, Hua Zhang1,2,*, Xingyu Zeng1, Xiaoxiang Deng1, Yuchen Zhou1, Xu Liu4
CMC-Computers, Materials & Continua, Vol.71, No.2, pp. 2315-2331, 2022, DOI:10.32604/cmc.2022.022540
Abstract The Internet Control Message Protocol (ICMP) covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission. Its concealment is stronger and it is not easy to be discovered. Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions. In this paper, we propose an ICMP covert tunnel attack intent detection framework ICMPTend, which includes five steps: data collection, feature dictionary construction, data preprocessing, model construction, and attack intent prediction. ICMPTend can detect a variety of attack intentions, such as shell attacks, sensitive directory access,… More >
Login
Register
