Detection of Covert Channel Encoding in Network Packet Delays

Dartmouth Technical Report TR2005-536

	Vincent Berk
	Annarita Giani
	George Cybenko

Date: August 2005

URL (PDF): <http://www.cs.dartmouth.edu/reports/TR2005-536-rev1.pdf> (144KB)

Abstract:
 Covert channels are mechanisms for communicating information in
 ways that are difficult to detect. Data exfiltration can be an
 indication that a computer has been compromised by an attacker
 even when other intrusion detection schemes have failed to detect
 a successful attack. Covert timing channels use packet
 inter-arrival times, not header or payload embedded information,
 to encode covert messages. This paper investigates the channel
 capacity of Internet-based timing channels and proposes a
 methodology for detecting covert timing channels based on how
 close a source comes to achieving that channel capacity. A
 statistical approach is then used for the special case of binary
 codes.

Note:
 This revision differs from the original only in  the correction of one
 reference.