A sensitive network jitter measurement for covert timing channels over interactive traffic

Abstract

In order to reflect the network transmission quality, some network state feedback mechanisms are provided in the network protocol. In the RTP, the jitter of the packet transmission delay is fed back through the jitter field in the RTCP packet. This feedback value is a very important reference data when the covert timing channel is established. However, the sending frequency of the RTCP packet is low and the feedback value of the RTCP packet are only the jitter value of the last RTP packet associated with this RTCP packet when it is sent. Therefore, the jitter feedback mechanism in the existing RTCP protocol has the problem of lack of feedback on the network state during the period between two RTCP data packets. As a result, the feedback value is highly susceptible to extreme values, which prevents it from providing an accurate numerical reference for establishing covert channels. Therefore, in this paper, a buffer was established between the last RTCP packet and the current RTCP packet. And we choose to set the interval is n RTP packets and record the corresponding position jitter value in the buffer. The data in the buffer is averaged, and the mean value is weighted and averaged with the jitter value of the current RTCP packet as a new jitter feedback value. The effect of the extreme value on the feedback value is reduced, thereby it contribute to the improvement of the feedback energy for the state of the network. In addition, the bit error rate generated by establishing a simple covert timing channel for data transmission under different network conditions is compared with the change of two jitter feedback values. It is verified that there is a positive correlation between the feedback value of the new feedback mode and the error rate. through the comparison It is verified that the new feedback method can provide a more accurate reference for the establishment of covert channels.