Generic and Sensitive Anomaly Detection of Network Covert Timing Channels

Li, Haozhi; Tian, Shiming; Yang, Yating

doi:10.1109/tdsc.2022.3207573

Cited by 4 publications

(12 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…So far we have shown that ϵ-κlibur can circumvent both, the compressibility score and the ϵ-similarity, and that the enhanced ϵ-similarity method outperforms both classical heuristics. While the main focus of our work was to demonstrate weaknesses and exploitability of these classical heuristics, we additionally evaluate ϵ-κlibur against two recent machine learning-based detection methods: GAS [13] and SnapCatch [14] as introduced in Sect. 3.2.…”

Section: Evaluation Of ϵ-κLibur With Sophisti-cated Detection Methodsmentioning

confidence: 99%

“…Li et al proposed another machine learning-based pipeline called Generic and Sensitive (GAS) anomaly detection in [13], which employs a recurrent neural network (RNN), in particular an LSTM. GAS has shown good performance on timing channel detection.…”

Section: Improvements and Derivatives Of The Detection Heuristicsmentioning

confidence: 99%

“…To evaluate the GAS detection approach, we used the code and models provided by the original authors [13] and conducted three tests. We first tested the original covert channel, then ϵ-κlibur and ϵ-κlibur-O.…”

Section: Gasmentioning

confidence: 99%

“…Among these are two highly cited ones by Cabuk et al that were published between 2004 and 2009 [10]- [12]. Research work has improved over these algorithms during the succeeding decade, leading to mostly ML-based detection methods, such as the recent GAS [13] (RNN-based) and SnapCatch (based on image processing and ML) [14] methods that reach almost perfect detection quality.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Zillien

Wendzel

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Network covert channels are applied for the secret exfiltration of confidential data, the stealthy operation of malware, and legitimate purposes, such as censorship circumvention. In recent decades, some major detection methods for network covert channels have been developed. In this paper, we investigate two highly cited detection methods for covert timing channels, namely ϵ-similarity and compressibility score from Cabuk et al. (jointly cited by 930 papers and applied by thousands of researchers). We additionally analyze two recent ML-based detection methods: GAS (2022) and SnapCatch (2021). While all these detection methods must be considered valuable for the analysis of typical covert timing channels, we show that these methods are not reliable when a covert channel's behavior is slightly modified. In particular, we demonstrate that when confronted with a simple covert channel that we call ϵ-κlibur, all detection methods can be circumvented or their performance can be significantly reduced although the covert channel still provides a high bitrate. In comparison to previous timing channels that circumvent these methods, ϵ-κlibur is much simpler and eliminates the need of altering previously recorded traffic. Moreover, we propose an enhanced ϵ-similarity that can detect the classical covert timing channel as well as ϵ-κlibur.

show abstract

Section: Evaluation Of ϵ-κLibur With Sophisti-cated Detection Methodsmentioning

confidence: 99%

Section: Improvements and Derivatives Of The Detection Heuristicsmentioning

confidence: 99%

Section: Gasmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Zillien

Wendzel

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…The dataset used is the publicly available dataset provided in Reference 23. This dataset contains two sub‐datasets corresponding to the traffic under LAN and WAN.…”

Section: Viability Analysismentioning

confidence: 99%

A generalized detection framework for covert timing channels based on perceptual hashing

Zhuang,

Chen,

Tian

2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Network covert channels use network resources to transmit data covertly, and their existence will seriously threaten network security. Therefore, an effective method is needed to prevent and detect them. Current network covert timing channel detection methods often incorporate machine learning methods in order to achieve generalized detection, but they consume a large amount of computational resources. In this paper, we propose a generalized detection framework for covert channels based on perceptual hashing without relying on machine learning methods. And we propose a one‐dimensional data feature descriptor for feature extraction of perceptual hash for the data characteristics of covert timing channels. We first generate the hash sequence of the corresponding channel to get the average hash, which is used for comparison in the test phase. The experimental results show that the feature descriptor can capture the feature differences of one‐dimensional data well. When compared to machine learning methods, this perceptual hashing algorithms enable faster traffic detection. Meanwhile, our method is able to detect the effectiveness with the smallest coverage window compared with the latest solutions. Moreover, it exhibits robustness in jitter network environment.

show abstract