HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

Algorithm 1

Interaction process extraction algorithm.

	Input: Labeled packets in the session flow: Packet = {packet1, packet2, ..., packetN}
	Output: Interaction process sequence
	Tmp ← []
	Interaction ← []
	for packeti ∈ Packet do
	if packeti.label ! = 2 && packeti + 1.label = = 2 then
	Tmp.append (packeti)
	j ← 1
	while i + j < N && packeti + j.label = = 2 do
	Tmp.append (packeti + j)
	j ← j + 1
	end while
	Interaction.append (Tmp)
	Tmp.clear
	end if
	end for
	return Interaction