A Technique to Limit Packet Length Covert Channels

Abstract

We designed the technique to estimate and limit the capacity of the covert channel based on traffic padding and random increase of packets lengths. It was applied to two types of packet size covert channels namely binary and multi-symbol channels. The method to choose the parameter of counteraction tool is given, it takes into account an allowable value of covert channel capacity and error level. The investigation carried out is significant because such type of covert channels could be constructed even if traffic encryption is used. The novelty of the investigation undertaken is that the covert channel capacity is limited preliminary, whereas state of the art methods focus on detecting active IP covert channels.