Detection of Telnet Covert Channel based on SVM
Min Luo · Information Security and Communications Privacy · 2012
The covert channel based on Telnet attaches the hidden message to the telnet packet and sends it to theremote server,and this channel is very difficult to be detected because of the arbitrary keyboard operation.This paper analyzes the covert channel technologies based on Telnet,and proposes a detection method for the covert channel.The detection method uses one-class support vector machine(SVM),and by capturing the user's normal operation of the network packets as the template and making use of the time interval between samples,constructs the detection vector.Experiment indicates that,with this method,the detection rate for the covert channel based on telnet could reach 100%,while the false detection rate is fairly low.