HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

<table class="table-group" id="tab2"><tr><td><table class="table"><tr><td class="thead-hr" colspan="2"><hr/></td></tr><tr class="thead"><td class="align_left">Category</td><td class="align_center">Cookie content</td></tr><tr><td class="thead-hr" colspan="2"><hr/></td></tr><tr><td class="align_left">Normal communication</td><td class="align_center">lkqdidts = 1499100526; lkqdid = uZRUClndZ2M; <br/>p_0 = H4sIAAAAAAAAAJXKMQ6DMAwAwIkKRZ2YeEAXhIywk5D4NZW<br/>dOFIf0E_yE7rxA7bu3HzO949hKt9PfStR44YeYjMDREuQWSIgsVH1qiR5P<br/>H_H3rmlfw6vgKu2LAkYOUIo4kEoGWyxWsioXDT8_3zzL3f-BUl0ezPFAAAA</td></tr><tr><td class="align_left" colspan="2"><hr/></td></tr><tr><td class="align_left">Covert channel</td><td class="align_center">sKk = aiTLT6Y2GVgJJlLKk%2Bvw<br/>Ds7X%2BoR828cfLHACuRf3lRYTvn%2FQRr30OnXnpgI%3D; CMgnxG1BWA = 2xZzPwGZXPbIuaC05wEqZfKBA35vW1Sv<br/>OIl8h7BVfT%2BDDDQE4p0S; LljG5YM = 9KU9iG%2BIkxtwXsBuBjPWYcClMkqZVS6gkQnC</td></tr><tr class="table-tr"><td colspan="2"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

Security and Communication Networks

tab2

Table 2

Table 2: HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features 