Packet Length Covert Channel: A Detection Scheme

Elsadig, Muawia A.; Fadlalla, Yahia A.

doi:10.1109/cais.2018.8442026

Cited by 12 publications

(13 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The test results also illustrated that covert channel detection effectiveness increases as applying data labeling. The machine learning‐based detection scheme was presented, and the authors selected frequency‐based features training data, and make a comparison between different machine learning models, getting a relatively competitive accuracy of 98% 48‐49 …”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Towards robust and stealthy communication for wireless intelligent terminals

Chen

Qiu

Zhang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Fifth‐generation (5G) wireless systems provide an opportunity for improving the existing Voice over Internet Protocol communication service's user experience. To mitigate the security risk of 5G data leakage, building covert channel is an alternative approach of providing confidential data transmission. Due to the high transmission rate of 5G, the interpacket intervals become small and derandomized, this caused the encoding phase of the covert timing channel imports relatively large modulation errors. rearranging is a widespread phenomenon that is occurred over the data communications. In this paper, we propose a rearrangement covert channel approach named Hybrid Variable‐length Packet Rearrangement Covert Timing Channel (HVPR‐CTC), which artificially chooses the delimiter packets and identification (ID) packets from the overt traffics, and encodes the packet sending order between adjacent delimiter packets according to a generated hybrid variable‐length codeword dictionary, and embeds the secret message by rearranging the sending order of the ID packets. The experiments demonstrate that the HVPR‐CTC scheme can effectively perform strategy adjustment: its minimum Location Square Deviation is 0.832 and minimum Swap Deviation is 139. the maximum throughput reaches 14.37 bps, and the optimal Bit Error Rate is 3.27% and 9.70% for low‐channel noise and high‐channel noise communication conditions, respectively.

show abstract

Section: Related Workmentioning

confidence: 99%

“…The machine learning-based detection scheme was presented, and the authors selected frequency-based features training data, and make a comparison between different machine learning models, getting a relatively competitive accuracy of 98%. [48][49]…”

Section: Related Workmentioning

confidence: 99%

Towards robust and stealthy communication for wireless intelligent terminals

Chen

Qiu

Zhang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

show abstract

“…These changes cover modifications on the underlay layer, changes inside the virtual networks typically concern to changes of the ip-addresses used. The use of length parameters of the protocols like frame.len and ip.len is useful for the detection of various covert channels like discussed in [34]. So there is no defined list of relevant protocol fields, which should be used for anomaly detection in network forensic investigation.…”

Section: Protocolmentioning

confidence: 99%

Impact of Virtual Networks on Anomaly Detection with Machine Learning

Spiekermann

Keller

2020

2020 6th IEEE Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

The enormous number of network packets transferred in modern networks together with the high-speed transmissions hamper the implementation of successful IT security mechanisms. In addition to this, virtual networks create highly dynamic and flexible environments, which differ widely from well-known infrastructures of the past decade. Network forensic investigation aiming at the detection of covert channels, malware usage or anomaly detection is faced with new problems and gets a time-consuming, error-prone and complex process. Machine learning provides advanced techniques to perform this work faster with a lower error rate. Depending on the learning technique, algorithms work nearly without any necessary interaction to detect relevant events in the transferred network packets. Occurring changes are noticed and additional processes might be started. Current algorithms work well in static environments, but the highly-dynamic environments of virtual networks create additional events, which might irritate the anomaly detection algorithms. This paper analyses virtual network protocols like VXLAN, GRE and GENVE and their impact of the detection rate of anomalies in the environment. Our research shows the need for adapted pre-processing of the network data, in the worst case on demand if changes are detected.

show abstract

“…More advanced and detection-proof techniques are presented in [17,24,28,30]. Additionally, in [15,22] are shown two length-based covert channel detection schemes. Even if the exploited constraints of the Smart Config protocols are already known to the scientific community, the application of a such technique for the configuration of IoT devices is quite new.…”

Section: Related Workmentioning

confidence: 99%

A (in)Secure-by-Design IoT Protocol

Salzillo

Rak

2020

Proceedings of the 2020 Joint Workshop on CPS&IoT Security and Privacy

View full text Add to dashboard Cite

The number of IoT devices designed and marketed in these last years is continuously growing. These smart things are more often managed through the cloud, therefore more and more devices are connected both to the customer's local networks and to the Internet. Among the several network pairing mechanisms designed for the IoT domain, we examined the Smart Config family of protocols, a clever technology that allows an IoT device to be associated with an existing WiFi network by receiving special packets from an already network-paired smartphone. We investigate the threats and the technical details behind the ESP Touch protocol, a Smart Config implementation developed by Espressif Systems for its ESP32/8266 family of chips. Additionally, we present a security analysis of the same protocol implemented by the ITEAD Sonoff smart switches (and also by many other ESP-based devices), that we conducted by reverse-engineering the eWeLink mobile companion application. In conclusion, we describe a vulnerability (published as CVE-2020-12702) we found in the Quick Pairing mode of the eWeLink SDK that leads to a full WiFi credential disclosure during the device pairing process.

show abstract

Packet Length Covert Channel: A Detection Scheme

Cited by 12 publications

References 22 publications

Towards robust and stealthy communication for wireless intelligent terminals

Towards robust and stealthy communication for wireless intelligent terminals

Impact of Virtual Networks on Anomaly Detection with Machine Learning

A (in)Secure-by-Design IoT Protocol

Contact Info

Product

Resources

About