A portable microcontroller-based HTTP tunnelling activity detection system

In this paper we present a portable fuzzy-logic based intrusion detection system that makes use of behavior profiles and signature matching techniques to detect Hyper Text Transfer Protocol (HTTP) tunnelling activities. The HTTP tunnelling is defined as techniques to use the HTTP protocol to encapsulate illegal and harmful messages within HTTP data. The portable system, whose function is governed by a Motorola 68HC12 microcontroller, is designed to detect both malicious and unauthorized HTTP tunnelling activities: (1) interactive tunnelling sessions, (2) scripted tunnelling sessions, and (3) unauthorized video and audio stream sessions. Preliminary experimental data show the validity of the proposed system.