HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

<table class="table-group" id="tab5"><tr><td><table class="table"><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr class="thead"><td class="align_left">Symbol</td><td class="align_center">Statistics</td><td class="align_center">Contribution ranking</td></tr><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr><td class="align_left">F1</td><td class="align_center">Information quantity of cookie</td><td class="align_center">3</td></tr><tr><td class="align_left">F2</td><td class="align_center">Dispersion degree of cookie length</td><td class="align_center">6</td></tr><tr><td class="align_left">F3</td><td class="align_center">Character level difference of adjacent cookies</td><td class="align_center">5</td></tr><tr><td class="align_left">F4</td><td class="align_center">Information quantity of response content</td><td class="align_center">2</td></tr><tr><td class="align_left">F5</td><td class="align_center">Dispersion degree of response content length</td><td class="align_center">7</td></tr><tr><td class="align_left">F6</td><td class="align_center">Information quantity comparison of response content and cookie</td><td class="align_center">4</td></tr><tr><td class="align_left">F7</td><td class="align_center">Information quantity comparison of set-cookie and cookie</td><td class="align_center">1</td></tr><tr class="table-tr"><td colspan="3"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

Security and Communication Networks

tab5

Table 5

Table 5: HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features 