A Novel Timing-based Network Covert Channel Detection Method
Shoupu Lu, Zhifeng Chen, Guangxin Fu, Qingbao Li · Journal of Physics Conference Series · 2019
Abstract Network stealth events are endless, and covert timing channel is one of the most difficult means to prevent. In order to further improve the detection rate of covert timing channel, several typical network covert timing channel construction algorithms are analyzed. On the basis of the above analysis, a detection method based on IPDs multidimensional features was proposed in this paper. IPDs of covert timing channels from three dimensions: shape, change rule and data statistics are analyzed. Respectively, polarization feature, autocorrelation feature, clustering feature are proposed, and the three features are unified into a model. The threshold method is used to determine whether the channel to be detected is a normal channel. Experiments show that the method can detect the existing covert timing channel with less time cost and compared with the traditional detection method has a certain rate of improvement.