Detection method for Liquid covert timing channels
Hua Jin · Jisuanji gongcheng yu sheji · 2012
IP convert timing channel is seriously threatening the information security of network users.The detection method based on entropy is the most effective one so far,which can detect the known IP convert timing channel.And the liquid convert timing channel advanced recently divides the packet sequence into two parts,avoiding the entropy detection effectively by compensating each other.According to the characteristics of Liquid,the entropy detection method based on the slide window is proposed in the paper.The method firstly finds out the convert information sequence and the compensation packet sequence,and then carries out its detection on the basis of the entropy diversity existing in the two packet sequences of normal communications and Liquid communications.The results of many experiments indicate that the method can detect the liquid convert timing channel successfully.