Embedding a Covert Channel in Active Network Connections

Khan, Hassan; Javed, Yousra; Mirza, Fauzan; Khayam, Syed Ali

doi:10.1109/glocom.2009.5425348

Cited by 8 publications

(11 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to their application scenarios, undetectability has been regarded as the most important performance metric of covert timing channels since the birth of this technique. Covert timing channels can be categorized as three types: rate-based [4,20], packet-reordering-based [21,22], and IPD-based [6,17]. Among them, IPD-based covert timing channel is the main focus of the theoretical and implemention studies on covert timing channel.…”

Section: Related Workmentioning

confidence: 99%

Designing Rich-Secure Network Covert Timing Channels Based on Nested Lattices

2019

KSII TIIS

View full text Add to dashboard Cite

As the youngest branch of information hiding, network covert timing channels conceal the existence of secret messages by manipulating the timing information of the overt traffic. The popular model-based framework for constructing covert timing channels always utilizes cumulative distribution function (CDF) of the inter-packet delays (IPDs) to modulate secret messages, whereas discards high-order statistics of the IPDs completely. The consequence is the vulnerability to high-order statistical tests, e.g., entropy test. In this study, a rich security model of covert timing channels is established based on IPD chains, which can be used to measure the distortion of multi-order timing statistics of a covert timing channel. To achieve rich security, we propose two types of covert timing channels based on nested lattices. The CDF of the IPDs is used to construct dot-lattice and interval-lattice for quantization, which can ensure the cell density of the lattice consistent with the joint distribution of the IPDs. Furthermore, compensative quantization and guard band strategy are employed to eliminate the regularity and enhance the robustness, respectively. Experimental results on real traffic show that the proposed schemes are rich-secure, and robust to channel interference, whereas some state-of-the-art covert timing channels cannot evade detection under the rich security model.

show abstract

Section: Related Workmentioning

confidence: 99%

Designing Rich-Secure Network Covert Timing Channels Based on Nested Lattices

2019

KSII TIIS

View full text Add to dashboard Cite

show abstract

“…Inter-socket packet arrival order is also used to build a CTCC. In [Khan et al 2009], authors have proposed a high capacity CTCC based on inter-socket packet arrival order using multiple active connections. Their proposed CTCC is shown to be non-detectable by regularity based tests.…”

Section: Covert Timing Channel Communicationmentioning

confidence: 99%

“…Packets reorder in single flow [Ahsan and Kundur 2002;El-Atawy and Al-Shaer 2009] [ Chakinala et al 2007] Packets in a flow and multiple [Luo et al 2007;Luo et al 2012a] flows reorder Inter-socket packet arrival order [Khan et al 2009 [Archibald 2013;Archibald and Ghosal 2014]. Blind disruption means disrupting the possible presence of covert timing channel without detecting it.…”

Section: Main Attributes Packet Reordering Based Ctcc Workmentioning

confidence: 99%

A Survey of Timing Channels and Countermeasures

2017

View full text Add to dashboard Cite

A timing channel is a communication channel that can transfer information to a receiver/decoder by modulating the timing behavior of an agent. Examples of this agent include the inter-packet delays of a packet stream, reordering packets in a packet stream or resource access time of a cryptographic module. The advances in information theory and the availability of high performance computing systems interconnected by high speed networks, have spurred interest and development of various types of timing channels. With the emergence of complex timing channels, novel detection and prevention techniques are also being developed to counter them. In this paper we provide a detailed survey of timing channels broadly categorized into network timing channel in which communicating entities are connected by a network and in-system timing channel in which the communicating entities are within a computing system. This survey builds upon the last comprehensive survey by [Zander et al. 2007] and considers all the three canonical applications of timing channels namely, covert communication, timing side-channel, and network flow watermarking. We survey the theoretical foundations, the implementation, and the various detection and prevention techniques that have been reported in the literature. Based on the analysis of the current literature we articulate potential future research directions both in the design and applications of timing channels and their detection and prevention techniques.

show abstract

“…Previous research has introduced a good number of storage channels, with more recent research covering a wider range of protocols and network layers as seen in [6][7][8][9][10][11][12]. Several covert timing channels have been introduced as well such as that in [13], where the authors introduce one of the earlier basic timing channels using IP inter-packet arrival time (IAT) patterns.…”

Section: Chapter 2 Related Workmentioning

confidence: 99%

Covert DCF: A DCF-Based Covert Timing Channel in 802.11 Networks

Holloway¹,

Beyah

2011

2011 IEEE Eighth International Conference on Mobile Ad-Hoc and Sensor Systems

View full text Add to dashboard Cite

Covert channels are becoming more popular as security risks grow in networks. One area that is promising for covert channels is wireless networks, since many use a collision avoidance scheme such as carrier sense multiple access with collision avoidance (CSMA/CA).These schemes often introduce randomness in the network, which provides good cover for a covert timing channel. In this thesis, we use the 802.11 standard as an example to demonstrate a wireless covert channel. In particular, most 802.11 configurations use a distributed coordinated function (DCF) to assist in communications. This DCF uses a random backoff to avoid collisions, which provides the cover for our covert channel. Our timing channel provides great improvements on other recent covert channels in the field of throughput, while maintaining high accuracy. We are able to achieve throughput over 8000 bps using Covert DCF, or by accepting a throughput of 1800 bps we can achieve higher covertness and 99% accuracy as well.

show abstract

Embedding a Covert Channel in Active Network Connections

Cited by 8 publications

References 8 publications

Designing Rich-Secure Network Covert Timing Channels Based on Nested Lattices

Designing Rich-Secure Network Covert Timing Channels Based on Nested Lattices

A Survey of Timing Channels and Countermeasures

Covert DCF: A DCF-Based Covert Timing Channel in 802.11 Networks

Contact Info

Product

Resources

About