Covert Channel Detection in the ICMP Payload Using Support Vector Machine

Sohn, Taeshik; Moon, Jongsub; Lee, Sang-Jin; Lee, Dong Hoon; Lim, Jongsik

doi:10.1007/978-3-540-39737-3_103

Cited by 25 publications

(11 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although the introduction of a micro protocol influences the behavior of a covert communication, it is likely that the detection using known approaches, such as support vector machines , is feasible for SSH, FTP, and additional services.…”

Section: Resultsmentioning

confidence: 99%

Covert channel‐internal control protocols: attacks and defense

Kaur

Wendzel

Eissa

et al. 2016

Security Comm Networks

View full text Add to dashboard Cite

Network covert channels have become a sophisticated means for transferring hidden information over the network. Covert channel-internal control protocols, also called micro protocols, have been introduced in the recent years to enhance capabilities of the network covert channels. Micro protocols are usually placed within the hidden bits of a covert channel's payload and enable features such as reliable data transfer, session management, and dynamic routing for network covert channels. These features provide adaptive and stealthy covert communication channels. Some of the micro protocol based tools exhibit vulnerabilities and are susceptible to attacks. In this paper, we demonstrate some possible attacks on micro protocols, which are capable of breaking the sophisticated covert channel communication or jeopardizing the identity of peers in such a network. These attacks are based on the attacker's interaction with the micro protocol

show abstract

Section: Resultsmentioning

confidence: 99%

Covert channel‐internal control protocols: attacks and defense

Kaur

Wendzel

Eissa

et al. 2016

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…Using ICMP protocol as a medium for a covert channel, Sohn, et al [5] proposed a detection method based on Support Vector Machine (SVM) to learn ICMP packets payload characteristics. They used Loki2 to generate abnormal ICMP packets and Tcpdump to capture network traffic.…”

Section: Related Workmentioning

confidence: 99%

Detection of Covert Channels Over ICMP Protocol

Sayadi

Abbes

Bouhoula³

2017

2017 IEEE/ACS 14th International Conference on Computer Systems and Applications (AICCSA)

View full text Add to dashboard Cite

With the growing complexity of networks and communications protocols that become increasingly enormous and extensive, we are confronted with the problem of covert channel that affects the confidentiality and integrity of data sent in the network. Covert channels also known as hidden channels can elude basic security systems such as Intrusion Detection Systems (IDS) and firewalls. We propose in this work a method to monitor and detect the presence of hidden channels that are based on an essential monitoring protocol "Internet Control Message Protocol" (ICMP). We undergo the network traffic with a set of verifications ranging from simple fields verification to more complex pattern matching operations. To validate our idea, we have installed Ptunnel, a tool that allows to tunnel TCP connections to a remote host using ICMP echo request and reply packets. Our experimental results show the possibility to discover such malicious traffic with high performance.

show abstract

“…But this classifier has been tested against only one CTC. In [22,23], the authors have successfully used the SVM classifier techniques for classifying specific CSCs. The authors discuss covert channels that use TCP/IP header fields such as IP Identification and Sequence Number, and ICMP payload traffic and detect them using a SVM based pattern classifier.…”

Section: Literature Surveymentioning

confidence: 99%

A Support Vector Machine-Based Framework for Detection of Covert Timing Channels

Shrestha

Hempel

Rezaei

et al. 2016

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Covert channels exploit side channels within existing network resources to transmit secret messages. They are integrated into the elements of network resources that were not even designed for the purpose of communication. This means that traditional security features like firewalls cannot detect them. Their ability to evade detection makes covert channels a grave security concern. Hence, it is imperative to detect and disrupt them. However, a generic mechanism that can be used to detect a large variety of covert channels is missing. In this paper, we propose a Support Vector Machine (SVM)-based framework for reliable detection of covert communications. The machine learning framework utilizes the fingerprints derived from the traffic under investigation to classify the traffic as covert or overt. We trained our classifier using the fingerprints from four popular and diverse covert timing channel algorithms and tested each of them independently. We have shown that the machine learning framework has great potential to blindly detect covert channels, even when the covert message size is reduced. His research interests include theoretical and mathematical modeling, wireless communications, signal processing, high-speed networks, network security, among others.

show abstract

Covert Channel Detection in the ICMP Payload Using Support Vector Machine

Cited by 25 publications

References 4 publications

Covert channel‐internal control protocols: attacks and defense

Covert channel‐internal control protocols: attacks and defense

Detection of Covert Channels Over ICMP Protocol

A Support Vector Machine-Based Framework for Detection of Covert Timing Channels

Contact Info

Product

Resources

About