Analysis and efficiency criteria of modern methods and technique for detecting encapsulated TCP/IP traffic packets

Makukha Maxim Yurievich, Klyuev Stanislav Gennadievich

one of the main methods of covert transmission of information from an attacked network is encapsulation within the existing network Protocol. Therefore, we consider the detection of encapsulated protocols to be an important direction for government agencies and civil organizations seeking to prevent the loss of valuable information. The paper considers modern methods and methods of organizing network protection, their advantages and disadvantages are noted. On the basis of the conducted research, efficiency criteria were proposed. The purpose of this study is a comparative analysis of methods and methods for detecting encapsulated TCP/IP traffic packets, as well as determining the criteria for their effectiveness for further use in network security systems and tools. The materials of this work are of theoretical value for further research in this field.

Keywords:methods for detecting abuse, methods for detecting anomalies, knowledge-based methods, behavioral methods, data mining methods.