Abstract:Network covert timing channels can be maliciously used to exfiltrate secrets, coordinate attacks and propagate malwares, posing serious threats to cybersecurity. Current covert timing channels normally conduct small-volume transmission under the covers of various disguising techniques, making them hard to detect especially when a detector has little priori knowledge of their traffic features. In this paper, we propose a generic and sensitive detection approach, which can simultaneously (i) identify various types of channels without their traffic knowledge and (ii) maintain reasonable performance on small traffic samples. The basis of our approach is the finding that the short-term timing behavior of covert and legitimate traffic is significantly different from the perspective of inter-packet delays' variation. This phenomenon can be a generic reference to detect various channels because it is resistant to major channel disguising techniques which only mimic long-term traffic features, while it is also a sensitive reference to spot small-volume covert transmission since it can capture traffic anomalies in a fine-grained manner. To obtain the inner patterns of inter-packet delays' variation, we design a context-sensitive feature-extraction technique. This technique transforms each raw inter-packet delay into a discrete counterpart based on its contextual properties, thus extracting its variation features and reducing traffic data complexity. Then we learn legitimate variation patterns using a neural network model, and identify samples showing anomalous variation as covert. The experimental results show that our approach effectively detects all currently representative channels in the absence of their knowledge, presenting once to twice higher sensitivity than the state-of-the-art solutions.

A Communication-Channel-based Method for Detecting Deeply Camouflaged Malicious Traffic

Detecting Malicious TLS Network Traffic Based on Communication Channel Features

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

Two-layer detection framework with a high accuracy and efficiency for a malware family over the TLS protocol

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

SSL Malicious Traffic Detection Based On Multi-view Features.

An Encrypted Malicious Traffic Detection System Based on Neural Network

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

Encrypted Malicious Traffic Detection Based on Word2Vec

Discovering Unknown Advanced Persistent Threat Using Shared Features Mined by Neural Networks.

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

Identification Domain Fronting Traffic for Revealing Obfuscated C2 Communications

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Generic and Sensitive Anomaly Detection of Network Covert Timing Channels