Support Vector Machine Based ICMP Covert Channel Attack Detection

Sohn, Taeshik; Noh, Taewoo; Moon, Jongsub

doi:10.1007/978-3-540-45215-7_46

Cited by 5 publications

(5 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For some complex storage channels, such as ISN-based or ICMP-based ones (Sohn et al, 2003a;Tumoian and Anikeev, 2005a), it is difficult to detect them only via examining single packets. Thus, some artificial intelligence techniques, including support vector machine, neural network, etc., are utilized to find the abnormality of header fields and detect these channels (Sohn et al, 2003a,b;Tumoian and Anikeev, 2005a).…”

Section: Channel Detection and Countermeasuresmentioning

confidence: 99%

“…Till now, many fields in the TCP/IP suite of protocols have been revealed to hide information, including IP checksum, IP TTL, TCP initial sequence number, IP timestamp, etc. Accordingly, a series of encoding schemes are introduced to hide the information into these fields, and kinds of covert storage channels (Zander et al, 2007b;Abad, 2001;Giffin et al, 2002;Sohn et al, 2003a) have been introduced. In network covert timing channels, the transmission time of the media packets is used to carry information.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Implementing a passive network covert timing channel

Yao

Pan

et al. 2010

Computers & Security

View full text Add to dashboard Cite

Section: Channel Detection and Countermeasuresmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Implementing a passive network covert timing channel

Yao

Pan

et al. 2010

Computers & Security

View full text Add to dashboard Cite

“…In , the authors investigate the possibility of information hiding within the protocol headers of Long Term Evolution (LTE) Advanced. Although the CSC methods offer promising capacity for embedding hidden information, these algorithms are not reliable enough and can be detected by relatively simple techniques .…”

Section: Literature Reviewmentioning

confidence: 99%

A novel automated framework for modeling and evaluating covert channel algorithms

Rezaei

Hempel

Sharif

2014

Security Comm. Networks

View full text Add to dashboard Cite

In this paper, we introduce an automated framework that can model covert communication algorithms. Our proposed framework, Automated Covert Channel Modeling (ACCM), can provide a reliable and valid implementation method for fully functional covert communication techniques that can be used to study various concepts, characteristics and features of covert communication. ACCM exploits the shared features of covert channel algorithms to define common blocks and automatically converts tasks and events of the common blocks to executable codes. In order to verify the accuracy of our proposed ACCM framework, we implement two different covert channel algorithms that are referenced repeatedly in literature. We demonstrate that the characteristics obtained from implementing covert communication using the ACCM framework match the theoretical concepts of network communication and the expected results.

show abstract

“…Covert channels are the principle enablers in a distributed denial of service (DDoS) attack that causes a denial of service to legitimate machines. 39 A DDoS attacker covertly distributes (portions of) his attack tools over many machines spread across the Internet, and later triggers these intermediary machines into beginning the attack and remotely coordinates the attack.…”

Section: Covert Channelsmentioning

confidence: 99%