Timing Covert Channels Detection Cases via Machine Learning
Anna Vasilievna Epishkina, Mikhail Finoshin, Konstantin Kogos, Aleksandra Yazykova · 2019
Currently, packet data networks are widespread. Their architectural features allow constructing covert channels that are able to transmit covert data under the conditions of using standard protection measures. However, encryption or packets length normalization, leave the possibility for an intruder to transfer covert data via timing covert channels (TCCs). In turn, inter-packet delay (IPD) normalization leads to reducing communication channel capacity. Detection is an alternative countermeasure. At the present time, detection methods based on machine learning are widely studied. The complexity of TCCs detection based on machine learning depends on the availability of traffic samples, and on the possibility of an intruder to change covert channels parameters. In the current work, we explore the cases of TCCs detection via machine learning and study the possibility to implement learning machines algorithms for detecting TCCs under conditions of varying covert channel characteristics: flow capacity and encoding scheme.