Web tap: detecting covert web traffic

摘要: As network security is a growing concern, system administrators lock down their networks by closing inbound ports and only allowing outbound communication over selected protocols such as HTTP. Hackers, in turn, are forced to find ways communicate with compromised workstations tunneling through web requests. While several tools attempt analyze traffic for denial-of-service other attacks on servers, Web Tap's focus detecting attempts send significant amounts of information out via HTTP tunnels rogue servers from within an otherwise firewalled network. A related goal Tap help detect spyware programs, which often personal data using transactions may open up holes the Based analysis training period, we designed filters anomalies metrics request regularity, bandwidth usage, inter-request delay time, transaction size. Subsequently, was evaluated available covert programs well test backdoor program, creates remote shell outside protected machine transactions. detected all tested after modest use. also analyzed activity approximately thirty faculty students who agreed use it proxy server 40 day period. It successfully number aware programs. This paper presents design Tap, results its evaluation, potential limits capabilities.