Covert timing channel method based on TCP timestamp option
Wang Pen · Journal of PLA University of Science and Technology · 2015
To improve the reliability and detection resistance of computer network,a new type of covert timing channel was proposed.A new type of descriptive method of Inter-Packet-Delay was proposed,named Recording Inter-Packet-Delay.Inter-Packet-Delay and the new channel through the use of transmission control protocol(TCP)timestamp option were constructed.By adopting the reliable delivery service and retransmission mechanism of TCP,the proposed channel can improve the transmission accuracy under harsh network environments.By slightly modifying the timestamp at the same time using entropy shaping method,the proposed channel can make the channel more difficult to be detected.The proposed channel was constructed under transmission control protocol/internet protocol(TCP/IP)network,and compared with the traditional covert timing channel in reliability and detection resistance through experiments.Experiments show that the proposed channel performs better than the traditional channel in the transmission accuracy under harsh network environments,and that it is enough to resist entropy based detection as well.