SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

Al-Eidi, Shorouq; Darwish, Omar; Chen, Yuanzhu; Husari, Ghaith

doi:10.1109/access.2020.3046234

Cited by 20 publications

(12 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…So far we have shown that ϵ-κlibur can circumvent both, the compressibility score and the ϵ-similarity, and that the enhanced ϵ-similarity method outperforms both classical heuristics. While the main focus of our work was to demonstrate weaknesses and exploitability of these classical heuristics, we additionally evaluate ϵ-κlibur against two recent machine learning-based detection methods: GAS [13] and SnapCatch [14] as introduced in Sect. 3.2.…”

Section: Evaluation Of ϵ-κLibur With Sophisti-cated Detection Methodsmentioning

confidence: 99%

“…Al-Eidi et al proposed a new detection method called SnapCatch [14]. For this approach, network traffic is first transformed into 16x16 pixel images to afterwards extract several features rooted in image processing, like mean grey value, center of mass and standard deviation of grey values.…”

Section: Improvements and Derivatives Of The Detection Heuristicsmentioning

confidence: 99%

“…Similar to GAS, we evaluated SnapCatch [14] with three datasets. The original covert channel, ϵ-κlibur and ϵ-κlibur-O.…”

Section: Snapcatchmentioning

confidence: 99%

“…Among these are two highly cited ones by Cabuk et al that were published between 2004 and 2009 [10]- [12]. Research work has improved over these algorithms during the succeeding decade, leading to mostly ML-based detection methods, such as the recent GAS [13] (RNN-based) and SnapCatch (based on image processing and ML) [14] methods that reach almost perfect detection quality.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Zillien

Wendzel

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Network covert channels are applied for the secret exfiltration of confidential data, the stealthy operation of malware, and legitimate purposes, such as censorship circumvention. In recent decades, some major detection methods for network covert channels have been developed. In this paper, we investigate two highly cited detection methods for covert timing channels, namely ϵ-similarity and compressibility score from Cabuk et al. (jointly cited by 930 papers and applied by thousands of researchers). We additionally analyze two recent ML-based detection methods: GAS (2022) and SnapCatch (2021). While all these detection methods must be considered valuable for the analysis of typical covert timing channels, we show that these methods are not reliable when a covert channel's behavior is slightly modified. In particular, we demonstrate that when confronted with a simple covert channel that we call ϵ-κlibur, all detection methods can be circumvented or their performance can be significantly reduced although the covert channel still provides a high bitrate. In comparison to previous timing channels that circumvent these methods, ϵ-κlibur is much simpler and eliminates the need of altering previously recorded traffic. Moreover, we propose an enhanced ϵ-similarity that can detect the classical covert timing channel as well as ϵ-κlibur.

show abstract

Section: Evaluation Of ϵ-κLibur With Sophisti-cated Detection Methodsmentioning

confidence: 99%

Section: Improvements and Derivatives Of The Detection Heuristicsmentioning

confidence: 99%

“…Similar to GAS, we evaluated SnapCatch [14] with three datasets. The original covert channel, ϵ-κlibur and ϵ-κlibur-O.…”

Section: Snapcatchmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Zillien

Wendzel

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…Covert channels have better concealment compared with other stealing technology. Traditional network security measures methods, such as firewall, virus killing, and intrusion detection, cannot detect and defend the transmission of covert information [2]. Due to the good concealment, covert channels have brought serious threat to the security of user privacy, military secrets, and national cyberspace.…”

Section: Introductionmentioning

confidence: 99%

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Sun

Chen

Tian

et al. 2021

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.

show abstract

A Review on Network Covert Channel Construction and Attack Detection

Khadse,

Dakhane

2024

Concurrency and Computation

View full text Add to dashboard Cite

A covert network channel is a communication channel in which the message is secretly transmitted to the recipient. Sometimes, covert network channels are vulnerable to multiple attacks. Therefore, the message must be properly secure. In most cases, the covert channel is used to ensure data protection and allow users to freely access the Internet. In this paper, several recent studies are reviewed on covert network channels and examine the existing works from 2015 to 2024. This review article also discusses the undetectability and reliability of different types of covert network channels. Furthermore, a detailed description of the covert network channel's ability to hide in containers is provided. Existing research on covert network channels explains a few techniques for detecting attacks in secret data communication. However, several machine learning and deep learning techniques have been discussed in this article. Additionally, this article describes the accuracy of detection through an overview of current technologies. In addition, various countermeasures to prevent attacks in covert channels are also discussed in detail. However, in this case, the bandwidth limitations, data set limitations, and covert channel capacity are clearly defined, which will help future researchers build covert network channels and detect attacks. Finally, this work considers the challenges faced by covert network channels and the future scope of application.

show abstract

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

Cited by 20 publications

References 40 publications

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

A Review on Network Covert Channel Construction and Attack Detection

Contact Info

Product

Resources

About