HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

Table 3

Data collecting and processing information.

Data category	Data source	Filtered flows	Total flows
Normal	ISCXIDS2012 dataset	513	1304
Normal	CTU-normal	791
Abnormal	Malicious program	82	1045
	MD5: c0c8dcc9dad39da8278bf8956e30a3fc
Abnormal	Malicious program	78
	MD5: 07abd6583295061eac2435ae470eff78
Abnormal	Malicious program	181
	MD5: 37c89f291dbe880b1f3ac036e6b9c558
Abnormal	Malicious program	182
	MD5: 3afa9243b3aeb534e02426569d85e517
Abnormal	Malicious program	178
	MD5: f03f70d331c6564aec8931f481949188
Abnormal	Malicious program	175
	MD5: 684888079aaf7ed25e725b55a3695062
Abnormal	Malicious program	169
	MD5: 7891f00dcab0e4a2f928422062e94213