Decision Tree Rule Induction for Detecting Covert Timing Channels in TCP/IP Traffic

Iglesias, Félix; Bernhardt, Valentin; Annessi, Robert; Zseby, Tanja

doi:10.1007/978-3-319-66808-6_8

Cited by 16 publications

(13 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Eight of them are popular in the field of covert channel detection, widely described in [13] and in the original papers (we provide the corresponding references). The last two techniques have been published recently in [7].…”

Section: Explored Covert Timing Channel Techniquesmentioning

confidence: 99%

“…The specific field under study-IAT for the case of covert timing channels-is initially tackled from a time series analysis perspective. Further derived studies that focus on covert timing channels are developed in [13] and [15]. Here we explore the features used in these three cited works ( [12,13] and [15]) and add five new features related to regularity and randomness in time and symbol series.…”

Section: Selected Featuresmentioning

confidence: 99%

“…In [13] and [15] flows with less than two packets were removed instead. This difference makes current experiments more demanding and challenging as covert flows are only compared with overt flows that potentially look like covert flows.…”

Section: Overt Datasetsmentioning

confidence: 99%

“…As observed in [13], where features are selected by decision trees, c is stated as a decisive feature and ρ A is neglected. However, with regard to the previous work the importance of other features vary due to the inclusion of the new regularity and randomness features, derived redundancies and the influence of new feature combinations.…”

Section: Feature Selectionmentioning

confidence: 99%

“…The DAT methodology is based on representing traffic flows with a set of statistical measurements and estimations. In [13] and [15] the scope was reduced to timing channels, analyzing and testing the detection with supervised classification in [13] and with unsupervised algorithms in [15]. Even in spite of the fact that covert timing channels are anomalies from a semantic understanding, from the perspective of statistical properties they remain in zones also occupied by normal traffic, yet they can be differentiated by supervised analysis (as shown in [15]).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

V�zquez¹,

Annessi

Zseby

2017

JCSM

Self Cite

View full text Add to dashboard Cite

Covert timing channels are security threats that have concerned the expert community from the beginnings of secure computer networks. In this paper we explore the nature of covert timing channels by studying the behavior of a selection of features used for their detection. Insights are obtained from experimental studies based on ten covert timing channels techniques published in the literature, which include popular and novel approaches. The study digs into the shapes of flows containing covert timing channels from a statistical perspective as well as using supervised and unsupervised machine learning algorithms. Our experiments reveal which features are recommended for building detection methods and draw meaningful representations to understand the problem space. Covert timing channels show high histogramdistance based outlierness, but insufficient to clearly discriminate them from normal traffic. On the other hand, traffic features do show dependencies that allow separating subspaces and facilitate the identification of covert timing channels. The conducted study shows the detection difficulties due to the high shape variability of normal traffic and suggests the implementation of semi-supervised techniques to develop accurate and reliable detectors.

show abstract

Section: Explored Covert Timing Channel Techniquesmentioning

confidence: 99%