Implementation of Hybrid Artificial Intelligence Technique to Detect Covert Channels Attack in New Generation Internet Protocol IPv6

Salih, Abdulrahman; Ma, Xiaoqi; Peytchev, Evtim

doi:10.1007/978-3-319-43434-6_15

Cited by 14 publications

(12 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similar to many other threats, another emerging approach leverages machine learning. As an example, the work in [35] demonstrates the use of fuzzy logic and genetic algorithms to achieve high detection rates of covert channels targeting the IPv6 header. We point out that both methods require to employ deep packet inspection principles, thus impacting on the scalability of the approach.…”

Section: Ipv6mentioning

confidence: 99%

Trends and Challenges in Network Covert Channels Countermeasures

Caviglione

2021

Applied Sciences

View full text Add to dashboard Cite

Network covert channels are increasingly used to endow malware with stealthy behaviors, for instance to exfiltrate data or to orchestrate nodes of a botnet in a cloaked manner. Unfortunately, the detection of such attacks is difficult as network covert channels are often characterized by low data rates and defenders do not know in advance where the secret information has been hidden. Moreover, neutralization or mitigation are hard tasks, as they require to not disrupt legitimate flows or degrade the quality perceived by users. As a consequence, countermeasures are tightly coupled to specific channel architectures, leading to poorly generalizable and often scarcely scalable approaches. In this perspective, this paper investigates trends and challenges in the development of countermeasures against the most popular network covert channels. To this aim, we reviewed the relevant literature by considering approaches that can be effectively deployed to detect general injection mechanisms or threats observed in the wild. Emphasis has been put on enlightening trajectories that should be considered when engineering mitigation techniques or planning the research to face the increasing wave of information-hiding-capable malware. Results indicate that many works are extremely specialized and an effective strategy for taming security risks caused by network covert channels may benefit from high-level and general approaches. Moreover, mechanisms to prevent the exploitation of ambiguities should be already considered in early design phases of both protocols and services.

show abstract

Section: Ipv6mentioning

confidence: 99%

Trends and Challenges in Network Covert Channels Countermeasures

Caviglione

2021

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…As an example, let us consider the case of B = 2 12 bins with a size S = 2 8 values. If a packet with a Flow Label value equal to 337 (i.e., 0x00151) is observed, the second bin is flagged since it is the one containing values in the 256− 511 range (indexed by the 0x001 prefix).…”

Section: A Packet Inspection and Organizationmentioning

confidence: 99%

“…Unfortunately, literature mainly focused on threats exploiting IPv4, hence leaving the IPv6 counterpart largely unexplored [6], [9]- [11]. Besides, the inspection process is often tightly coupled with the used information hiding method: this makes the detection poorly generalizable and could lead to non-negligible computational burdens (e.g., to check protocol fields via deep packet inspection [12]).…”

Section: Introductionmentioning

confidence: 99%

Code Augmentation for Detecting Covert Channels Targeting the IPv6 Flow Label

Caviglione

Zuppelli

Mazurczyk

et al. 2021

2021 IEEE 7th International Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

Information hiding is at the basis of a new-wave of malware able to elude common detection mechanisms or remain unnoticed for long periods. To this aim, a key approach exploits network covert channels, i.e., abusive communication paths nested within a legitimate traffic flow. The increasing diffusion of IPv6 makes it attractive for an attacker, especially for the presence of the Flow Label field, which can be manipulated to contain up to 20 secret bits per packet. Unfortunately, gathering data to implement a standalone detection mechanism or to support third-party security tools is a poorly generalizable process and often leads to scalability issues. This paper showcases how to take advantage of code augmentation features (i.e., the extended Berkeley Packet Filter) to detect covert channels targeting the IPv6 Flow Label. To prove its effectiveness, the proposed approach has been tested against Internet-wide traffic traces collected in the wild. Results indicate that it is possible to spot the channel while mitigating the computational burden and the memory footprint.

show abstract

“…Using the synthetic dataset, the algorithm produced an overall accuracy, TPR and TNR of 99.5%, respectively. Hybrid artificial intelligence detection models for covert channel attacks in IPv6 were implemented by Saleh et al, [31].…”

Section: Review Of Related Workmentioning

confidence: 99%

“…Hybrid artificial intelligence detection models for covert channel attacks in IPv6 were implemented by Saleh et al 32 The hybridized framework used fuzzy logic and genetic algorithms, resulting to a robust model that optimally generated rules capable of detecting covert channels. The research resulted in the development of a detection model with a 97.7% detection rate, superior to state-of-the-art techniques.…”

Section: Review Of Related Workmentioning

confidence: 99%