MTBD: HTTPS Tunnel Detection Based on Multi-dimension Traffic Behaviors Decision

HTTPS protocol is one of the most important protocols on the Internet. Network firewalls generally do not block the HTTPS protocol, so a large number of malwares use HTTPS protocol as transmission tunnel for data leakage. It is difficult to detect HTTPS tunnel accurately using conventional handshake fingerprint and sequence detection methods. In this paper, we propose the MTBD method, which is a multi-stage detection method based on multi-dimension traffic behaviors. Firstly, we design a traffic burst detection algorithm to filter out 85% normal traffic. Then, in order to avoid the limitations of single dimensional features, we extract core heterogeneous features on flow, host and packet levels. Finally, we use machine learning methods to build models from above three dimensions separately, and vote to decide final results. Meanwhile, we build HTTPS tunnel services and collect datasets to verify effectiveness of MTBD method. The experimental results demonstrate that MTBD method achieves up to 99% precision and recall that is superior to state-of-the-art method.