TCP/IP Timing Channels: Theory to Implementation

Sellke, Sarah H.; Wang, C.-C.; Bagchi, Saurabh; Shroff, Ness B.

doi:10.1109/infcom.2009.5062145

Cited by 109 publications

(93 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If the IPGs of normal traffic are iid this channel cannot be detected. Sellke et al proposed another scheme for encoding covert data in IPGs and evaluated its performance based on experiments across the Internet [3]. Similar to [2] they also showed that timing channels can be made indistinguishable from normal traffic by mimicking normal iid IPGs.…”

Section: Related Workmentioning

confidence: 99%

“…Gianvecchio et al [2] and Sellke et al [3] proposed channels that are hard to detect because they perfectly mimic the shape of IPG distributions of real applications. However, they are hard to detect only if IPGs are independent identically-distributed (iid).…”

Section: Introductionmentioning

confidence: 99%

“…However, we found that IPGs of several applications, such as UDP-based game and VoIP traffic and TCP traffic, often are not iid because there is auto-correlation. The channel proposed in [2,3] is easy to detect with such applications.…”

Section: Introductionmentioning

confidence: 99%

“…The channel in [2,3] requires accessible sequence numbers in the overt traffic. Otherwise any lost packets desynchronise covert sender and receiver.…”

Section: Introductionmentioning

confidence: 99%

“…In Section 4 we propose our new channel. In Section 5 we analyse the detection accuracy for the channel in [2,3] and our improved channel using machine learning. In Section 6 we analyse the capacity of our improved channel.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Stealthier Inter-packet Timing Covert Channels

2011

View full text Add to dashboard Cite

Abstract. Covert channels aim to hide the existence of communication. Recently proposed packet-timing channels encode covert data in inter-packet times, based on models of inter-packet times of normal traffic. These channels are detectable if normal inter-packet times are not independent identically-distributed, which we demonstrate is the case for several network applications. We show that~80% of channels are detected with a false positive rate of 0.5%. We then propose an improved channel that is much harder to detect. Only~9% of our new channels are detected at a false positive rate of 0.5%. Our new channel uses packet content for synchronisation and works with UDP and TCP traffic. The channel capacity reaches over hundred bits per second depending on overt traffic and network jitter.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…The channel in [2,3] requires accessible sequence numbers in the overt traffic. Otherwise any lost packets desynchronise covert sender and receiver.…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Stealthier Inter-packet Timing Covert Channels

2011

View full text Add to dashboard Cite

show abstract

Middleman covert channel establishment based on MORE routing protocol using network coding in ad hoc networks

Akhtari

Moghim

Mahdavi

2020

Int J Communication

View full text Add to dashboard Cite

Covert channels have been recently the subject of the study in both creation and countermeasure aspects. There are many different ways to embed the covert data in network standards and protocols, especially in wireless networks. MORE (MAC-independent opportunistic routing) is an opportunistic routing protocol which uses networks coding to enhance routing performance by reducing the repetitions. This protocol can be a suitable medium for covert channel establishment. A middleman covert channel establishment method is proposed in this paper over MORE routing protocol and with the use of network coding. Hidden data are transferred through packet's payload bytes. Covert sender manipulates coding mechanism by calculating packets' coefficients instead of random selection. The proposed covert channel provides the average throughput of 218 and 231 bps, using two different data length approaches which is relatively a good comparing to the previous network layer covert channels. The proposed covert channel is also a covert storage channel and cannot be removed or restricted. Effect of different network characteristics on the proposed method's capacity and security is investigated by a simulation study, and the results are discussed. K E Y W O R D Scovert channel, network coding, network steganography, opportunistic routing protocols

show abstract

A generalized detection framework for covert timing channels based on perceptual hashing

Zhuang,

Chen,

Tian

2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Network covert channels use network resources to transmit data covertly, and their existence will seriously threaten network security. Therefore, an effective method is needed to prevent and detect them. Current network covert timing channel detection methods often incorporate machine learning methods in order to achieve generalized detection, but they consume a large amount of computational resources. In this paper, we propose a generalized detection framework for covert channels based on perceptual hashing without relying on machine learning methods. And we propose a one‐dimensional data feature descriptor for feature extraction of perceptual hash for the data characteristics of covert timing channels. We first generate the hash sequence of the corresponding channel to get the average hash, which is used for comparison in the test phase. The experimental results show that the feature descriptor can capture the feature differences of one‐dimensional data well. When compared to machine learning methods, this perceptual hashing algorithms enable faster traffic detection. Meanwhile, our method is able to detect the effectiveness with the smallest coverage window compared with the latest solutions. Moreover, it exhibits robustness in jitter network environment.

show abstract

TCP/IP Timing Channels: Theory to Implementation

Cited by 109 publications

References 15 publications

Stealthier Inter-packet Timing Covert Channels

Stealthier Inter-packet Timing Covert Channels

Middleman covert channel establishment based on MORE routing protocol using network coding in ad hoc networks

A generalized detection framework for covert timing channels based on perceptual hashing

Contact Info

Product

Resources

About