Fundamental Limits of Covert Packet Insertion

Abstract

Covert communication conceals the existence of the transmission from a watchful adversary. We consider the fundamental limits for covert communications via packet insertion over packet channels whose packet timings are governed by a renewal process of rate λ. Authorized transmitter Jack sends packets to authorized receiver Steve, and covert transmitter Alice wishes to transmit packets to covert receiver Bob without being detected by watchful adversary Willie. Willie cannot authenticate the source of the packets. Hence, he looks for statistical anomalies in the packet stream from Jack to Steve to attempt detection of unauthorized packet insertion. First, we consider a special case where the packet timings are governed by a Poisson process and we show that Alice can covertly insert O( √ λT ) packets for Bob in a time interval of length T ; conversely, if Alice inserts ω( √ λT ), she will be detected by Willie with high probability. Then, we extend our results to general renewal channels and show that in a stream of N packets transmitted by Jack, Alice can covertly insert O( √ N ) packets; if she inserts ω( √ N ) packets, she will be detected by Willie with high probability. [56]-[62] by leveraging information-theoretic analysis and the use of various coding techniques [40], [63], [64]. In particular, Anantharam and Verdu [65] derived the Shannon capacity of the timing channel with a single-server queue, and Dunn [66] analyzed the secrecy capacity of such a system. Per above, here we take a fundamental approach analogous to [12]-[23], but turn our attention to covert communication over wired channels in which communication takes place through packet transmissions.Specifically, we consider the scenario shown in Fig. 1. Authorized transmitter Jack sends packets to authorized receiver Steve. Assume that Alice wishes to transmit data covertly to Bob on this channel in the presence of an adversary, Willie, who is monitoring the channel. Willie can be in one of the two locations, either between Alice and Bob (Setting 1), or between Bob and Steve (Setting 2). Alice and Bob know that Willie is located at one or the other of these two places; however, they do not know which place he is located at. We assume Willie cannot authenticate the source of the packets (e.g., whether they are sent by Jack or not). However, he knows the statistical model of the timings of the packets transmitted by Jack. Alice can buffer and release Jack's packets and insert her own packets.Also, Bob can authenticate packets, remove the ones originally inserted by Alice, and buffer and release Jack's packets. We assume Alice can only send information to Bob by inserting her own packets into the channel, since she is not allowed to share a secret codebook with Bob and thus she is not able to send covert messages to Bob via packet timings; i.e., altering the timing of the packets according to a shared codebook, to embed information in inter-packet delays (IPDs) [65]. In addition, transmission of information through packet timings is sensitive to natural ...

Fundamental scaling laws of covert DDoS attacks

“…By using the bound in (D.1) we obtain Under the second condition in ( 16), the coefficients of x 2 in the various exponentials in (E.3) are always strictly negative, which shows that the integral in (E.3) is finite for every r and n. We conclude from that and conditions in ( 10)- (11) and in ( 16) that sup 1≤r≤n 1 n n r=1 σ 2 0,r + q(n)σ 2 1 (n) + q(n)(1 − q(n))µ 2 1 (n)   = φ(−∞) = 0, (G.9) by continuity of the mapping φ.…”

“…Our work is related to recent work on low probability of detection (LPD) communications, which has been mostly studied in the realm of wireless com-munications [11,12,13,10]. The LPD problem focuses on determining the maximum amount of information that a party, Alice, can reliably transmit to a receiver, Bob, subject to a constraint on the detection probability by a warden, Willy [14].…”

“…The covertness criterion considered in this paper was proposed in the context of low probability of detection (LPD) communications. Although there are a number of papers in this area [10,11,12,13,14], to the best of our knowledge no previous work has discussed hypothesis testing methods for DDoS detection in home networks, particularly focusing on covertness. We are also unaware of prior work analyzing the fundamental laws of covert DDoS attacks through theoretical bounds derived from optimal statistical hypothesis tests.…”

Minimax and adaptive tests for detecting abrupt and possibly transitory changes in a Poisson process

“…An abrupt change in the intensity of the Poisson process may reveal a significant health phenomenon when the process models epidemiological data (see [100] for a review), malicious activity or intrusion attempt when it models packet or session arrival processes in internet traffic (see [88], [20], [67], [106] or [99]), or a change of attack pattern when it models the occurrences of cyber attacks against a cyber system (see [33] and [61]). Another cyber security problem, considered in [97], [98] and [108], concerns communication over Poisson packet channels. In such a channel, an authorised transmitter sends packets to an authorised receiver according to a Poisson process, and a covert transmitter wishes to communicate some informations to a covert receiver on the same channel without being detected by a watchful adversary.…”