DeepAI AI Chat
Log In Sign Up

Protocol-independent Detection of "Messaging Ordering" Network Covert Channels

by   Steffen Wendzel, et al.

Detection methods are available for several known covert channels. However, a type of covert channel that received little attention within the last decade is the "message ordering" channel. Such a covert channel changes the order of PDUs (protocol data units, i.e. packets) transferred over the network to encode hidden information. The advantage of these channels is that they cannot be blocked easily as they do not modify header content but instead mimic typical network behavior such as TCP segments that arrive in a different order than they were sent. Contribution: In this paper, we show a protocol-independent approach to detect message ordering channels. Our approach is based on a modified compressibility score. We analyze the detectability of message ordering channels and whether several types of message ordering channels differ in their detectability. Results: Our results show that the detection of message ordering channels depends on their number of utilized PDUs. First, we performed a rough threshold selection by hand, which we later optimized using the C4.5 decision tree classifier. We were able to detect message ordering covert channels with an accuracy and F1 score of >= 99.5 they use sequences of 3 or 4 PDUs, respectively. Simpler channels that only manipulate a sequence of two PDUs were detectable with an accuracy and F1 score of 94.5 our approach suitable for real-world detection scenarios with channels utilizing 3 or 4 PDUs while the detection of channels utilizing 2 PDUs should be improved further.


page 1

page 2

page 3

page 4


Anomaly Detection: How to Artificially Increase your F1-Score with a Biased Evaluation Protocol

Anomaly detection is a widely explored domain in machine learning. Many ...

DCASE 2018 Challenge: Solution for Task 5

To address Task 5 in the Detection and Classification of Acoustic Scenes...

Channel Inclusion Beyond Discrete Memoryless Channels

Partial ordering of communication channels has applications in performan...

On the Preservation of Properties when Changing Communication Models

In a system of processes that communicate asynchronously by means of FIF...

Rough Set Based Color Channel Selection

Color channel selection is essential for accurate segmentation of sky an...

Optimizing Channel Selection for Seizure Detection

Interpretation of electroencephalogram (EEG) signals can be complicated ...

The incel lexicon: Deciphering the emergent cryptolect of a global misogynistic community

Evolving out of a gender-neutral framing of an involuntary celibate iden...