Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

V�zquez, F�lix Iglesias; Annessi, Robert; Zseby, Tanja

doi:10.13052/jcsm2245-1439.632

Cited by 5 publications

(3 citation statements)

References 21 publications

(40 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that most techniques manipulate Inter Departure Times (IDTs) in origin, which transform into IATs in destination (in short, IAT � IDT + transmission_delays). An analytic study of the characteristics of different covert timing channel techniques is discussed in [35]. By default, CCgen comes with three timing techniques.…”

Section: Covert Timing Channelsmentioning

confidence: 99%

CCgen: Injecting Covert Channels into Network Traffic

Iglesias

Meghdouri

Annessi

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Covert channels are methods to convey information clandestinely by exploiting the inherent capabilities of common communication protocols. They can be used to hide malware communication as part of cyber attacks. Here, we present CCgen, a framework for injecting covert channels into network traffic that includes modules for common covert channels at the network and transport layer and allows a smooth integration of novel covert channel techniques. Our tool—openly available and implemented in Python—enables the operation on-the-fly in live communications as well as the manipulation of network traffic packet captures. We evaluate a first prototype by generating a varied assortment of covert channels based on state-of-the-art techniques and check their detectability with Suricata, a popular, open-source intrusion prevention and detection system. The injected covert channels remain mostly undetected. Our proposal fills a gap within the diversity of openly available tools for cybersecurity research and education. It builds a flexible environment for experts to test analysis algorithms, thus also enabling advanced training in applied network steganography.

show abstract

Section: Covert Timing Channelsmentioning

confidence: 99%

CCgen: Injecting Covert Channels into Network Traffic

Iglesias

Meghdouri

Annessi

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…The inter-arrival times of legitimate traffic only depend on the current network environment. But the inter-arrival times mainly depend on the covert information to be transmitted in CTCs [27]. Therefore, many popular methods distinguish between CTCs and legitimate traffic by some statistical characteristics of inter-arrival times flow.…”

Section: B Popular Ctcs Detection Approachesmentioning

confidence: 99%

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Sun

Chen

Tian

et al. 2021

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.

show abstract

“…Decision Tree classifier also used in [30] for identifying and detecting covert timing channels. Moreover, in order to improve the accuracy of covert channel detection, the authors in [31,32], used unsupervised machine learning methods to classify and detect covert timing channels based on the statistical properties of network traffic. Recently, in [33], a new covert timing channel detection method proposed based on using deep neural networks and a set of statistical features extracted from the flow of inter-arrival times using the hierarchical statistical-based method.…”

Section: Covert Timing Channels Detection Approachesmentioning

confidence: 99%

Covert Timing Channel Analysis Either as Cyber Attacks or Confidential Applications

Al-Eidi

Darwish

Chen

2020

Sensors

View full text Add to dashboard Cite

Covert timing channels are an important alternative for transmitting information in the world of the Internet of Things (IoT). In covert timing channels data are encoded in inter-arrival times between consecutive packets based on modifying the transmission time of legitimate traffic. Typically, the modification of time takes place by delaying the transmitted packets on the sender side. A key aspect in covert timing channels is to find the threshold of packet delay that can accurately distinguish covert traffic from legitimate traffic. Based on that we can assess the level of dangerous of security threats or the quality of transferred sensitive information secretly. In this paper, we study the inter-arrival time behavior of covert timing channels in two different network configurations based on statistical metrics, in addition we investigate the packet delaying threshold value. Our experiments show that the threshold is approximately equal to or greater than double the mean of legitimate inter-arrival times. In this case covert timing channels become detectable as strong anomalies.

show abstract

Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

Cited by 5 publications

References 21 publications

CCgen: Injecting Covert Channels into Network Traffic

CCgen: Injecting Covert Channels into Network Traffic

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Covert Timing Channel Analysis Either as Cyber Attacks or Confidential Applications

Contact Info

Product

Resources

About