Cloak: A Ten-Fold Way for Reliable Covert Communications

Wang, Liu; Chan, Ehw; Chang, Rocky K. C.

doi:10.1007/978-3-540-74835-9_19

Cited by 32 publications

(27 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The detection of covert timing channels is accomplished using statistical tests to differentiate covert traffic from legitimate traffic. While the focus of earlier work is on disrupting covert timing channels [9], [10], [11], [12], [13] or on eliminating them in the design of systems [14], [15], [16], more recent research has begun to investigate the design and detection of covert timing channels [1], [2], [3], [4], [17], [5], [18]. In the following subsections, we give an overview of recent research on covert timing channels and detection tests.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Luo et al [4] designed a combinatorics-based scheme, called Cloak, to transmit information in the ordering of packets within different flows. Cloak can be considered as a storage and timing channel, as the encoding methods require packets and/or flows to be distinguishable by their contents.…”

Section: Other Covert Timing Channelsmentioning

confidence: 99%

“…However, due to the high variation in legitimate network traffic, detection methods based on standard statistical tests are not accurate and robust in capturing a covert timing channel. Although there have been recent research efforts on detecting covert timing channels over the Internet [1], [2], [3], [4], [5], some detection methods are designed to target one specific covert timing channel and therefore fail to detect other S. Gianvecchio types of covert timing channels; the other detection methods are broader in detection but are over-sensitive to the high variation of network traffic. In short, none of the previous detection methods are effective at detecting a variety of covert timing channels.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Entropy-Based Approach to Detecting Covert Timing Channels

Gianvecchio

Wang

2011

IEEE Trans. Dependable and Secure Comput.

118

110

View full text Add to dashboard Cite

Abstract-The detection of covert timing channels is of increasing interest in light of recent exploits of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. Existing detection schemes are ineffective at detecting most of the covert timing channels known to the security community. In this paper, we introduce a new entropybased approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropybased approach is sensitive to the current covert timing channels and is capable of detecting them in an accurate manner.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Other Covert Timing Channelsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Entropy-Based Approach to Detecting Covert Timing Channels

Gianvecchio

Wang

2011

IEEE Trans. Dependable and Secure Comput.

118

110

View full text Add to dashboard Cite

show abstract

“…ACKLeaks can evade contentbased detection methods and can be implemented by exploiting the existing TCP connections. Cloak [69] is a Active warden and egress filtering [34] new class of reliable timing covert channels, which encodes a message by a unique distribution of N packets over X TCP flows with ten different encoding and decoding methods, and carefully crafted to mimic the normal TCP flows. Sender can establish HTTP session with a remote server which consists of several TCP flows, or with multiple servers.…”

Section: Steganography In Transport Layermentioning

confidence: 99%

Covert channels in TCP/IP protocol stack - extended version-

Mileva

Panajotov

2014

Open Computer Science

View full text Add to dashboard Cite

We give a survey of different techniques for hiding data in several protocols from the TCP/IP protocol stack.Techniques are organized according to affected layer and protocol. For most of the covert channels its data bandwidth is given. IntroductionAn overt channel is a communication channel within a computer system or network, designed for the authorized transfer of data. A covert channel (first introduced by Lampson [62]), on the other hand, is any communication channel that can be exploited by a process to transfer information in a manner that violates the systems security policy [26]. Any shared resource can potentially be used as a covert channel. Covert channels can be divided primarily in storage and timing channels. In a case of the storage channels, usually one process writes (directly or indirectly) to a shared resource, while another process reads from it. Timing channel is essentially any technique that conveys information by the timing of events, in which case the receiving process needs a clock. Special timing covert channel is counting channel which carries data by counting the occurrences of certain events [44].Additionally, timing channels can be active if they generate additional traffic or passive if they manipulate the timing of existing traffic. As any other communication channel, covert channel can be noisy or noiseless.According to the number of information flows between the sender and the receiver -several or one, there are aggregated and non-aggregated covert channels [36]. According to the presence or absence of the intermediate node in the communication, covert channels can be indirect or direct. Payload tunnel is a covert channel, where one protocol is tunnelled in the payload of the other protocol. Covert channels are studied as a part of the science * E-mail: aleksandra.mileva@ugd.edu.mk † E-mail: boris.panajotov@ugd.edu.mk steganography, and different steganographic methods used in telecommunication networks are known as network steganography.The adversary model is based on the Simmons prisoner problem [105]: two parties want to communicate confidentially and undetected over an insecure channel, the warden. The warden can be passive -which monitor traffic and report when some unauthorized traffic is detected, or active -which can modify the content of the messages with the purpose of eliminating any form of hidden communication. Simmons introduced the term subliminal channel, a variant of covert channel which uses cryptographic algorithm or protocol for hiding messages. A composition of covert channel with subliminal channel is the hybrid channel.Covert channels can be analysed by the total number of steganogram bits transmitted during a second (Raw Bit Rate -RBR), or by the total number of steganogram bits transmitted per PDU (for example, Packet Raw BitRate-PRBR) [78]. In ideal case, if no packets are lost, capacity of some storage channels can be expressed as Steganography in Internet layerInternet Protocol (IP) is the primary protocol in the TCP/IP protocol stack, ...

show abstract

“…The detection of covert timing channels is mainly accomplished using statistical tests to differentiate covert traffic from legitimate traffic. While the focus of earlier work is on the disruption of covert timing channels [4][5][6][7][8], more recent research has begun to investigate the design and detection of covert timing channels [9][10][11][12]14].…”

Section: Related Workmentioning

confidence: 99%

Model-Based Covert Timing Channels: Automated Modeling and Evasion

Gianvecchio

Wang

Wijesekera

et al.

Lecture Notes in Computer Science

105

133

View full text Add to dashboard Cite

Abstract. The exploration of advanced covert timing channel design is important to understand and defend against covert timing channels. In this paper, we introduce a new class of covert timing channels, called model-based covert timing channels, which exploit the statistical properties of legitimate network traffic to evade detection in an effective manner. We design and implement an automated framework for building model-based covert timing channels. Our framework consists of four main components: filter, analyzer, encoder, and transmitter. The filter characterizes the features of legitimate network traffic, and the analyzer fits the observed traffic behavior to a model. Then, the encoder and transmitter use the model to generate covert traffic and blend with legitimate network traffic. The framework is lightweight, and the overhead induced by model fitting is negligible. To validate the effectiveness of the proposed framework, we conduct a series of experiments in LAN and WAN environments. The experimental results show that model-based covert timing channels provide a significant increase in detection resistance with only a minor loss in capacity.

show abstract

Cloak: A Ten-Fold Way for Reliable Covert Communications

Cited by 32 publications

References 6 publications

An Entropy-Based Approach to Detecting Covert Timing Channels

An Entropy-Based Approach to Detecting Covert Timing Channels

Covert channels in TCP/IP protocol stack - extended version-

Model-Based Covert Timing Channels: Automated Modeling and Evasion

Contact Info

Product

Resources

About