Covert Timing Channels(CTCs) is a technique to leak information. CTCs only modify inter-arrival time sequence(IATs) between packets, consequently, traditional network security mechanisms, such as firewalls and proxies, can not effectively detect CTCs. If CTCs are maliciously utilized by criminals, will pose a great threat to network security. Classic CTCs detection methods, such as KS-test, Entropy-test, etc, not only have less universality and robustness, but also require more sampled IATs to detect CTCs, therefore, how to improve performance of detection methods against CTCs, has became a popular research in recent years. In this paper, a new CTCs detection method based on time series symbolization is proposed. It firstly converts the sampled IATs to symbolic time series, and regards each discrete value as a status. Then counts the times of transition for each status to status, and calculates the status transition probability matrix(STPM). Finally, it differentiates the label(overt or covert) of sampled IATs, by calculating similarity score. Experimental results about detection accuracy show that, in an ideal network environment, compared with classic methods, our method has better performance, with average accuracy of about 96%. Besides, our method has better performance as well, with the existence of network interference.

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.