Covert Timing Channel Analysis Either as Cyber Attacks or Confidential Applications

Al-Eidi, Shorouq; Darwish, Omar; Chen, Yuanzhu

doi:10.3390/s20082417

Cited by 17 publications

(7 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Te second type of method extracts behavior statistical features by aggregating network fows and portrays covert behavior at the network fow level. Some works [14][15][16] mainly extracted the time information of the network fow as the feature to detect covert timing channels that use the time to encode information. Such methods obviously cannot detect HTTP cookie covert channels which do not use the time to encode information.…”

Section: Related Workmentioning

confidence: 99%

“…Te frst type of method classifes covert channels by setting thresholds for a small number of features. Relevant works [11,12,15] achieved the detection of covert channels by setting a threshold for a single complex feature. Such methods have good detection efects for specifc types of data but are relatively prone to low robustness of the detection model due to the low dimension of the extracted features.…”

Section: Covert Channel Classifcationmentioning

confidence: 99%

See 1 more Smart Citation

HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

Yuan

Chen

Zhu

et al. 2023

Security and Communication Networks

View full text Add to dashboard Cite

HTTP cookie covert channel is a covert communication method that encodes malicious information in cookie fields to escape regulatory audits. It is difficult to detect this kind of covert channel according to the cookie content because cookie fields are mainly encoded in custom modes. To effectively identify the HTTP cookie covert channel, this paper proposes a detection method based on the interaction features of the session flow. First, we split the HTTP session flow into fine-grained “interaction process” subflows to comprehensively describe the communication process of the cookie. Then, we compare and analyze the differences between HTTP cookie covert channels and normal cookie communications based on the interaction process, design three types of 7-dimensional features, and build the detection model combined with the machine learning algorithm. Experimental results show that our method can effectively detect HTTP cookie covert channels, and the detection rate can reach 99%. We also prove that our method has advantages in stability and time performance compared with the existing detection methods through experiment and analysis. In addition, our method has certain practicability in the simulation environment with imbalanced data.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Covert Channel Classifcationmentioning

confidence: 99%

HTTP Cookie Covert Channel Detection Based on Session Flow Interaction Features

Yuan

Chen

Zhu

et al. 2023

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…A covert channel is a communication channel used to transmit information by exploiting system resources that are not designed to convey data [23]. Commonly, there are two types of covert channels: timing and storage.…”

Section: Covert Channel Typesmentioning

confidence: 99%

Covert Channel Detection: Machine Learning Approaches

Elsadig

Gafar

2022

IEEE Access

View full text Add to dashboard Cite

The advanced development of computer networks and communication technologies has made covert communications easier to construct, faster, undetectable and more secure than ever. A covert channel is a path through which secret messages can be leaked by violating a system security policy. The detection of such dangerous, unwatchable, and hidden threats is still one of the most challenging aspects. This threat exploits methods that are not dedicated to communication purposes, meaning that traditional security measures fail to detect its existence. This review has introduced a brief introduction of covert channel definitions, types and developments, with a particular focus on detection techniques using machine learning (ML) approaches. It provides a thorough review of the most common covert channels and ML techniques that are used to counter them, as well as addressing their achievements and limitations. In addition, this paper introduces a comparative experimental study for some common ML approaches that are commonly used in this field. Accordingly, the performance of these classifiers was evaluated and reported. The paper concludes that our information is still at risk, nothing is said to be secured and more work on the detection of covert channels is required.INDEX TERMS Classification algorithms, covert channel detection, machine learning, covert traffic, covert storage channel, cover timing channel, deep learning, network traffic, network covert channels, overt traffic.

show abstract

“…Also, if the malicious agent greedy sends large covert massages, it will be easier to detect than agents that use smaller covert messages (e.g., 8 bits). We build on the work of Al-Eidi et al [1], which studied the effect of time-delays of covert traffic on the detection process. Their analysis discovered that using packet delays similar to the delays of overt traffic was a good strategy to evade detection.…”

Section: A Raw Data Generationmentioning

confidence: 99%