Evaluating the transmission rate of covert timing channels in a network

Abstract

Network covert channel is an illegal communication mechanism, which can be used by attackers to steal information from compromised systems. The channel brings serious security threat, which is usually measured by the information transmission rate achieved in the channel. In this paper, we focus on evaluating the transmission rate achieved by potential covert timing channels in a network. In such channels, the delay jitter and loss of media packets correspond to the communication noise, and impact the error probability of the channel communication. Based on the analysis of the network status (e.g. delay jitter, packet loss), we propose a method to evaluate the maximum transmission rate achieved by the potential channels in a network. Then we apply the evaluation method in a real network and obtain the maximum transmission rate, without constructing actual channels and any information transmission process over the channels. Additionally, we monitor the transmission rate changing with the network status in a day.