Detection of Network Time Covert Channels Based on Image Processing
Xuwen Huang, Yonghong Chen, Zhiqiang Li, Teng Zhan · 2023
Abstract: Network covert timing channels (NCTCs) utilize Inter-Packet Delay (IPD) encoding to hide data. It can be used for spreading malware and data leakage, posing severe threats to network security. With the increasing risk, the research on NCTC detection has become an important and urgent task. However, the detection methods based on IPD statistics are only effective for few types of channels and require large IPD sampling samples. The recent ML-based detection methods have multiple limitations due to their coarse-grained feature extraction method. In this paper, we propose a multi-channel image transformation method for extracting IPD features and select the lightweight network MobileVit for detection. We encode IPD one-dimensional time-series data into Gramian Angular Field (GAF), Markov Transition Field (MTF), and Recurrence plot (RP) images and stack them into dual-channel and three-channel images. After image transformation, we compare mainstream image classification networks and a self-built CNN. Experimental results show that our feature extraction image classification is more effective than the existing IPD extraction image transformation method. The MobileVit network shows better detection performance and accuracy, requiring fewer IPD sampling samples for detection windows.