Abstract:Network covert timing channels can be maliciously used to exfiltrate secrets, coordinate attacks and propagate malwares, posing serious threats to cybersecurity. Current covert timing channels normally conduct small-volume transmission under the covers of various disguising techniques, making them hard to detect especially when a detector has little priori knowledge of their traffic features. In this paper, we propose a generic and sensitive detection approach, which can simultaneously (i) identify various types of channels without their traffic knowledge and (ii) maintain reasonable performance on small traffic samples. The basis of our approach is the finding that the short-term timing behavior of covert and legitimate traffic is significantly different from the perspective of inter-packet delays' variation. This phenomenon can be a generic reference to detect various channels because it is resistant to major channel disguising techniques which only mimic long-term traffic features, while it is also a sensitive reference to spot small-volume covert transmission since it can capture traffic anomalies in a fine-grained manner. To obtain the inner patterns of inter-packet delays' variation, we design a context-sensitive feature-extraction technique. This technique transforms each raw inter-packet delay into a discrete counterpart based on its contextual properties, thus extracting its variation features and reducing traffic data complexity. Then we learn legitimate variation patterns using a neural network model, and identify samples showing anomalous variation as covert. The experimental results show that our approach effectively detects all currently representative channels in the absence of their knowledge, presenting once to twice higher sensitivity than the state-of-the-art solutions.

An Entropy-Based Method For Detection Of Covert Channels Over Lte

A Classifier Method for Detection of Covert Channels over LTE

Supervised Learning Framework for Covert Channel Detection in LTE-A.

A Hybrid Covert Channel Over LTE-A System

Research on Covert Channel Analysis in Tuling SecOS2.0/4

Hybrid Covert Channel in LTE-A: Modeling and Analysis.

Efficient Maximum Likelihood Detection with Imperfect Channel State Information for Interference-limited MIMO Systems

A Novel Covert Channel in LTE-A System

An Entropy-Based Approach to Detecting Covert Timing Channels

Building covert timing channels by packet rearrangement over mobile networks.

Generic and Sensitive Anomaly Detection of Network Covert Timing Channels

Exploiting Cantor Expansion For Covert Channels Over Lte-Advanced

Covert timing channel detection method based on time interval and payload length analysis

Building Undetectable Covert Channels Over Mobile Networks with Machine Learning.

A Hybrid Covert Channel with Feedback over Mobile Networks.

TCCBL:a Timing Covert Channel Based on LTE-A

Entropy Based Detection And Behavioral Analysis Of Hybrid Covert Channeling Secured Communication

A VoLTE Covert Channel with Intelligent Confrontation

A Packet-Reordering Covert Channel over VoLTE Voice and Video Traffics

Design of Low Probability Detection Signal with Application to Physical Layer Security