Are Network Covert Timing Channels Statistical Anomalies?

Iglesias, Félix; Zseby, Tanja

doi:10.1145/3098954.3106067

Cited by 9 publications

(15 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The specific field under study-IAT for the case of covert timing channels-is initially tackled from a time series analysis perspective. Further derived studies that focus on covert timing channels are developed in [13] and [15]. Here we explore the features used in these three cited works ( [12,13] and [15]) and add five new features related to regularity and randomness in time and symbol series.…”

Section: Selected Featuresmentioning

confidence: 99%

“…In [13] and [15] flows with less than two packets were removed instead. This difference makes current experiments more demanding and challenging as covert flows are only compared with overt flows that potentially look like covert flows.…”

Section: Overt Datasetsmentioning

confidence: 99%

“…Experiments slightly differ from the ones conducted in [15], where overt and covert datasets where presented together to the algorithms. Such experimental scheme might break the normal environment where covert channels appear by overpopulating the space with covert samples (in [15] they consisted on about 5% of the total flows). Covert channels are expected to be much more infrequent among overt data.…”

Section: Unsupervised Analysismentioning

confidence: 99%

“…The DAT methodology is based on representing traffic flows with a set of statistical measurements and estimations. In [13] and [15] the scope was reduced to timing channels, analyzing and testing the detection with supervised classification in [13] and with unsupervised algorithms in [15]. Even in spite of the fact that covert timing channels are anomalies from a semantic understanding, from the perspective of statistical properties they remain in zones also occupied by normal traffic, yet they can be differentiated by supervised analysis (as shown in [15]).…”

Section: Introductionmentioning

confidence: 99%

“…In [13] and [15] the scope was reduced to timing channels, analyzing and testing the detection with supervised classification in [13] and with unsupervised algorithms in [15]. Even in spite of the fact that covert timing channels are anomalies from a semantic understanding, from the perspective of statistical properties they remain in zones also occupied by normal traffic, yet they can be differentiated by supervised analysis (as shown in [15]). In other words, the separation boundaries between traffic flows with and without covert timing channels are not located in low density areas of the problem space (at least when analyzing the spaces created by the features studied in [15]).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

V�zquez¹,

Annessi

Zseby

2017

JCSM

Self Cite

View full text Add to dashboard Cite

Covert timing channels are security threats that have concerned the expert community from the beginnings of secure computer networks. In this paper we explore the nature of covert timing channels by studying the behavior of a selection of features used for their detection. Insights are obtained from experimental studies based on ten covert timing channels techniques published in the literature, which include popular and novel approaches. The study digs into the shapes of flows containing covert timing channels from a statistical perspective as well as using supervised and unsupervised machine learning algorithms. Our experiments reveal which features are recommended for building detection methods and draw meaningful representations to understand the problem space. Covert timing channels show high histogramdistance based outlierness, but insufficient to clearly discriminate them from normal traffic. On the other hand, traffic features do show dependencies that allow separating subspaces and facilitate the identification of covert timing channels. The conducted study shows the detection difficulties due to the high shape variability of normal traffic and suggests the implementation of semi-supervised techniques to develop accurate and reliable detectors.

show abstract