研究了恶意软件常采用的通信方式———隧道技术，并提出了一种基于Ｃ４．５的ＨＴＴＰ 隧道检测算法。该算法采用决策支持树算法 Ｃ４．５提取网络流特征字段，根据特征字段生成训练数据建立ＨＴＴＰ隧道分类的决策树检测模型，采用该分类模型检测ＨＴＴＰ隧道流，为检测恶意软件提供依据。-Malicious software often used means of communication--- tunneling technology, and a HTTP based on C4.5 Tunne

NeC4.5: Neural Ensemble Based C4.5 Zhi-Hua Zhou, Member, IEEE, and Yuan Jiang Abstract—Decision tree is with good comprehensibility while neural network ensemble is with strong generalization ability.