An Enlarging-the-Capacity Packet Sorting Covert Channel

Zhang, Lejun; Huang, Tianwen; Rasheed, Waqas; Hu, Xiaoyan; Zhao, Chunhui

doi:10.1109/access.2019.2945320

Cited by 10 publications

(6 citation statements)

References 29 publications

(20 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…L /( R − L )!, and its capacity is ⌊ log 2 N ⌋/ R in bits per packet. The capacity may be even higher if single-link NCCs are combined with Cloak to establish a hybrid covert channel [ 28 ].…”

Section: Methodsmentioning

confidence: 99%

Ordinal synchronization mark sequence and its steganography for a multi-link network covert channel

Wang

Dong

et al. 2021

PLoS ONE

View full text Add to dashboard Cite

A multi-link network covert channel (MLCC) such as Cloak exhibits a high capacity and robustness and can achieve lossless modulation of the protocol data units. However, the mechanism of Cloak involving an arrangement of packets over the links (APL) is limited by its passive synchronization schemes, which results in intermittent obstructions in transmitting APL packets and anomalous link switching patterns. In this work, we propose a novel ordinal synchronization mark sequence (OSMS) for a Cloak framework based MLCC to ensure that the marked APL packets are orderly distinguishable. Specifically, a unidirectional function is used to generate the OSMS randomly before realizing covert modulation. Subsequently, we formulate the generation relation of the marks according to their order and embed each mark into the APL packets by using a one-way hash function such that the mark cannot be cracked during the transmission of the APL packet. Finally, we set up a retrieval function of the finite set at the covert receiver to extract the marks and determine their orders, and the APL packets are reorganized to realize covert demodulation. The results of experiments performed on real traffic indicated that the MLCC embedded with OSMS could avoid the passive synchronization schemes and exhibited superior performance in terms of reliability, throughput, and undetectability compared with the renowned Cloak method, especially under a malicious network interference scenario. Furthermore, our approach could effectively resist the inter-link correlation test, which are highly effective in testing the Cloak framework.

show abstract

Section: Methodsmentioning

confidence: 99%

Ordinal synchronization mark sequence and its steganography for a multi-link network covert channel

Wang

Dong

et al. 2021

PLoS ONE

View full text Add to dashboard Cite

show abstract

“…Covert channels are mainly divided into two types: storage covert channels (SCC) and timing covert channels (TCT) [15]. In storage channels, storage location is used to hold a covert message [16] such as protocol fields, whereas in timing channels, a covert message is modulated using the timing characteristics of the network traffic.…”

Section: Covert Channel Typesmentioning

confidence: 99%

An ensemble model to detect packet length covert channels

Elsadig

Gafar

2023

IJECE

View full text Add to dashboard Cite

<span lang="EN-US">Covert channel techniques have enriched the way to commit dangerous and unwatched attacks. They exploit ways that are not intended to convey information; therefore, traditional security measures cannot detect them. One class of covert channels that difficult to detect, mitigate, or eliminate is packet length covert channels. This class of covert channels takes advantage of packet length variations to convey covert information. Numerous research articles reflect the useful use of machine learning (ML) classification approaches to discover covert channels. Therefore, this study presented an efficient ensemble classification model to detect such types of attacks. The ensemble model consists of five machine learning algorithms representing the base classifiers. The base classifiers include naive Bayes (NB), decision tree (DT), support vector machine (SVM), k-nearest neighbor (KNN), and random forest (RF). Whereas, the logistic regression (LR) classifier was employed to aggregate the outputs of the base classifiers and thus to generate the ensemble classifier output. The results showed a good performance of our proposed ensemble classifier. It beats all single classification algorithms, with a 99.3% accuracy rate and negligible classification errors.</span>

show abstract

“…A covert channel is unlike traditional secret message transfer methods in which not only the transmission content is hidden, but the transfer path itself is also protected [11]. In particular, network-covert channels maintain two aspects to secure the transmission of secret messages.…”

Section: Introductionmentioning

confidence: 99%

Covert Channel Detection: Machine Learning Approaches

Elsadig

Gafar

2022

IEEE Access

View full text Add to dashboard Cite

The advanced development of computer networks and communication technologies has made covert communications easier to construct, faster, undetectable and more secure than ever. A covert channel is a path through which secret messages can be leaked by violating a system security policy. The detection of such dangerous, unwatchable, and hidden threats is still one of the most challenging aspects. This threat exploits methods that are not dedicated to communication purposes, meaning that traditional security measures fail to detect its existence. This review has introduced a brief introduction of covert channel definitions, types and developments, with a particular focus on detection techniques using machine learning (ML) approaches. It provides a thorough review of the most common covert channels and ML techniques that are used to counter them, as well as addressing their achievements and limitations. In addition, this paper introduces a comparative experimental study for some common ML approaches that are commonly used in this field. Accordingly, the performance of these classifiers was evaluated and reported. The paper concludes that our information is still at risk, nothing is said to be secured and more work on the detection of covert channels is required.INDEX TERMS Classification algorithms, covert channel detection, machine learning, covert traffic, covert storage channel, cover timing channel, deep learning, network traffic, network covert channels, overt traffic.

show abstract

An Enlarging-the-Capacity Packet Sorting Covert Channel

Cited by 10 publications

References 29 publications

Ordinal synchronization mark sequence and its steganography for a multi-link network covert channel

Ordinal synchronization mark sequence and its steganography for a multi-link network covert channel

An ensemble model to detect packet length covert channels

Covert Channel Detection: Machine Learning Approaches

Contact Info

Product

Resources

About