研究了恶意软件常采用的通信方式———隧道技术，并提出了一种基于Ｃ４．５的ＨＴＴＰ

隧道检测算法。该算法采用决策支持树算法

Ｃ４．５提取网络流特征字段，根据特征字段生成训练数据建立ＨＴＴＰ隧道分类的决策树检测模型，采用该分类模型检测ＨＴＴＰ隧道流，为检测恶意软件提供依据。-Malicious software often used means of communication--- tunneling technology, and a HTTP based on C4.5

Tunnel detection algorithm. The algorithm uses a decision support tree algorithm

C4.5 extraction of network flow characteristics of the HTTP tunnel classification decision tree detection model, using the classification model checking HTTP tunnel flow field, according to the feature field generated training data provide the basis for the detection of malicious software.