Abstract: ICMP is used for network management technology.Network attackers often use it to carry out illegal actions such as remote control,data theft and malicious attacks.It is a common method of hidden communication in network attacks in recent years,which brings serious security risks to the victim host.In view of the increasingly severe situation of ICMP covert channel attacks and the characteristics of ICMP data flow that are complex,difficult to identify and have strong concealment,it is found that there are insufficient feature extraction when using machine learning to detect malicious traffic in ICMP covert channel in existing research,and the robustness and generalization ability of the model are poor.Therefore,a baseline feature-based malicious traffic detection method for ICMP covert channels is proposed to address these challenges.Firstly,the baseline analysis of ICMP benign traffic and covert channel traffic is carried out,and five features with good discrimination are proposed:average data packet length,data packet frequency,session duration,ratio of request to reply packets,and message data information entropy.Then,a binary classifier is constructed by combining multiple machine learning models for malicious traffic detection.The experimental results show that the accuracy,recall and F1 value of the proposed method reach 99.53%,99.51%and 99.5%respectively,which are 2.83 persentage points,2.97 persentage points and 2.88 persentage points higher than those of the existing methods.In addition,considering that the baseline features are easy to be bypass by attackers through dynamic adjustment or obfuscating techniques,this paper adds an ICMP tunnel detection method based on adversarial training and ensemble learning,which enhances the robustness of the model by generating adversarial samples,and combines the advantages of deep attention network and traditional machine learning models to effectively identify covert tunnel traffic.The proposed method mainly uses PGD attack to generate adversarial samples,introduces a multi-head attention mechanism to extract deep features,and predicts the results through MLP.The final accuracy is improved to 99.63%.Experiments show that the proposed method improves the detection accuracy and robustness in the adversarial environment.In addition,the proposed method has millisecond level traffic analysis and detection capabilities,which can effectively adapt to the actual ICMP covert channel traffic detection requirements.

Key words: ICMP covert channel, Baseline features, PGD, Attention mechanism, Machine learning