Learning to Behave: Improving Covert Channel Security with Behavior-Based Designs

Abstract

Censorship-resistant communication systems generally use real-world cover protocols to establish a covert channel through which uncensored communication can occur. Unfortunately, many previously proposed systems use cover protocols inconsistently with the way humans normally use those protocols, leading to anomalous network traffic patterns that have been shown to be discoverable by real-world censors. In this paper, we argue that censorship-resistant communication systems should follow two behavior-based design properties: (i) behavioral independence: systems should isolate the operation of their covert channels from the operation of their cover protocols, and (ii) behavioral realism: systems should either opportunistically use existing genuine cover protocol instances or run new protocol instances that are modeled after genuine ones. These properties ensure that the behavior of a system’s users will not degrade its security. We demonstrate how to achieve these properties through the design and evaluation of Raven, a censorship-resistant messaging system that uses email cover protocols identically to the way humans use email. Raven uses a generative adversarial network that is trained on genuine email data to control the timing and sizes of the email messages it sends and receives, and these messages are transferred independently of user actions. Our evaluation shows that, compared to the state-of-the-art email-based Mailet system, Raven raises the false-positive rate from 3% to 50% when detecting covert channel usage with 100% recall.

Communication Breakdown: Modularizing Application Tunneling for Signaling Around Censorship

“…Various systems meeting this signaling channel definition exist: meek and other domain fronting channels achieve this despite not satisfying indirectness; refraction routing approaches use routinglevel indirection [16]; various channels use email [20,32,37]; some use cloud storage services [4]; some use video streaming platforms [23]. A common factor to signaling channel unblockability requirements is a reliance on some existing service that the censor has either not thought to block or finds too costly to block.…”

“…Many existing application tunneling channels do not include any functionality of this sort. However, as recent research shows [32], this can leave a significant gap in security because it causes the cover application usage to be shaped by the user (whether a human or a circumvention application). Breaking this linkage provides behavioral independence [32] and enables evaluating the security of a channel independent of its eventual communications usage.…”

“…Raven [32]. Raven communicates over email services -it encrypts messages using GPG and then sends them to the recipient.…”