Open AccessA Novel Timing-based Network Covert Channel Detection Method
Author(s) -
Shoupu Lu,
Zhifeng Chen,
Guangxin Fu,
Qingbao Li
Publication year - 2019
Publication title -
journal of physics. conference series
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.21
H-Index - 85
eISSN - 1742-6596
pISSN - 1742-6588
DOI - 10.1088/1742-6596/1325/1/012050
Subject(s) - covert , computer science , covert channel , channel (broadcasting) , feature (linguistics) , cluster analysis , autocorrelation , pattern recognition (psychology) , data mining , algorithm , real time computing , artificial intelligence , statistics , mathematics , computer network , cloud computing , security information and event management , philosophy , linguistics , cloud computing security , operating system
Network stealth events are endless, and covert timing channel is one of the most difficult means to prevent. In order to further improve the detection rate of covert timing channel, several typical network covert timing channel construction algorithms are analyzed. On the basis of the above analysis, a detection method based on IPDs multidimensional features was proposed in this paper. IPDs of covert timing channels from three dimensions: shape, change rule and data statistics are analyzed. Respectively, polarization feature, autocorrelation feature, clustering feature are proposed, and the three features are unified into a model. The threshold method is used to determine whether the channel to be detected is a normal channel. Experiments show that the method can detect the existing covert timing channel with less time cost and compared with the traditional detection method has a certain rate of improvement.