Abstract: The attack-defense game of covert tunnels has lasted for more than 30 years. The main detection methods of existing covert tunnels include the detection of message data and structure, detection based on flow statistics and detection based on machine learning. With the development of relevant technologies, more and more covert tunnes are constructed through the application layer protocol. Firstly, this paper designs a covert tunnel based on HTTP protocol. The tunnel uses backdoor program to carry out concealed communication, and encrypts the communication data to make it more concealed. The experiment shows that the tunnel can bypass the firewall, 360 guard, and other security equipments. Secondly, this paper analyzes the structure and flow characteristics of this type of tunnel and proposes a detection method to extract high-distinction features for the structural features and statistical features of the message. Finally, machine learning method is selected for detection. Both SVM and decision tree can accurately detect this kind of covert tunnel, and have low false alarm rate and missing alarm rate.

Key words: covert tunnel, webshell, machine learning