Side-Channel Analysis for Detecting Protocol Tunneling

Abstract

Protocol tunneling is widely used to add security and/or privacy to Internet applications. Recent research has exposed side channel vulnerabilities that leak information about tunneled protocols. We first discuss the timing side channels that have been found in protocol tunneling tools. We then show how to infer Hidden Markov models (HMMs) of network protocols from timing data and use the HMMs to detect when protocols are active. Unlike previous work, the HMM approach we present requires no a priori knowledge of the protocol. To illustrate the utility of this approach, we detect the use of English or Italian in interactive SSH sessions. For this example application, keystroke-timing data associates inter-packet delays with keystrokes. We first use clustering to extract discrete information from continuous timing data. We use discrete symbols to infer a HMM model, and finally use statistical tests to determine if the observed timing is consistent with the language typing statistics. In our tests, if the correct window size is used, fewer than 2% of data windows are incorrectly identified. Experimental verification shows that on-line detection of language use in interactive encrypted protocol tunnels is reliable. We compare maximum likelihood and statistical hypothesis testing for detecting protocol tunneling. We also discuss how this approach is useful in monitoring mix networks like The Onion Router (Tor).

Using Markov Models and Statistics to Learn, Extract, Fuse, and Detect Patterns in Raw Data

“…In an interactive SSH session, users' keystroketiming data are associated with inter-packet delays. In [20], the inter-packet delays are used to determine the language used by the victim. This is achieved by comparing the observed data with the HMM of known languages.…”

“…Markov models have been widely used for detecting patterns [33,36,7,4,24,25,15,17]. The premise behind a Markov models is that the current state only depends on the previous state and that transition probabilities are stationary.…”

“…(b) A coarse MLE localization has been performed over the detector field. The center of each grid region was used as input parameters for(4). The grid region with a red border and a black dot at the center is the area selected by the search.…”

A survey of electric power synchrophasor network cyber security

“…Side-channels extract information by observing implementation artifacts. For example, a timing side-channel vulnerability for SSH has been used to extract the system password from interactive sessions and detect the protocols being used within the encrypted communications [24]. In [25] researchers found that it is possible to detect PMU measurement sessions even when a VPN encrypts the traffic.…”