Network covert timing channel with distribution matching

Abstract

Network covert timing channel is a communication fashion that modifies the timing properties of network traffic to transfer secret information. It is designed to carry out the reliable and undetectable transmission. In this paper, a simple and secure covert timing channel method with distribution matching is proposed. The approach treats the network traffic as the flow with the fixed-length fragment, and calculates the histogram of the packet delays in each fragment. The message bits are modulated into the delays by the binary coding method, and the histogram is kept almost unchanged by assigning the matched distribution. The bit error rates are analyzed and two detection experiments are performed. The results show the proposed method is reliable and undetectable.