Covert Timing Channels Research Articles

A generalized detection framework for covert timing channels based on perceptual hashing

AbstractNetwork covert channels use network resources to transmit data covertly, and their existence will seriously threaten network security. Therefore, an effective method is needed to prevent and detect them. Current network covert timing channel detection methods often incorporate machine learning methods in order to achieve generalized detection, but they consume a large amount of computational resources. In this paper, we propose a generalized detection framework for covert channels based on perceptual hashing without relying on machine learning methods. And we propose a one‐dimensional data feature descriptor for feature extraction of perceptual hash for the data characteristics of covert timing channels. We first generate the hash sequence of the corresponding channel to get the average hash, which is used for comparison in the test phase. The experimental results show that the feature descriptor can capture the feature differences of one‐dimensional data well. When compared to machine learning methods, this perceptual hashing algorithms enable faster traffic detection. Meanwhile, our method is able to detect the effectiveness with the smallest coverage window compared with the latest solutions. Moreover, it exhibits robustness in jitter network environment.

A Covert Timing Channels Data Encryption Sceme In Cloud Simulation

A Covert Timing Channels Data Encryption Sceme In Cloud Simulation

A Comprehensive Survey on Exploring Covert Timing Channels in Network Security

Covert timing channels play pivotal roles in spying, hacking, and data theft, enabling secret communication and surreptitious data exchange. They also find utility in secure conversations, message concealment, security testing, and privacy protection, underscoring their versatile application across diverse domains. However, the accuracy of covert timing channels may be compromised by network traffic patterns and time delays, potentially affecting data integrity. This survey paper primarily provides an brief overview of identifying and mitigating these influencing factors of existing covert timing channels and presents a suggested system that integrates Reversible Covert Timing Channel (CTC) steganography and Elliptic Curve Cryptography (ECC) to ensure secure communication and data encryption. By leveraging this combination, the system aims to enhance the resilience of covert communication channels against adversarial interference while safeguarding the confidentiality and integrity of transmitted data.

Increasing the virtual machine's performance optimized run-length encoding as a covert timing channel

Increasing the virtual machine's performance optimized run-length encoding as a covert timing channel

A Novel Covert Timing Channel Based on Bitcoin Messages

Covert channels serve the construction of cyberspace security. By realizing the secure transmission of data, it is widely used in political and financial fields. Blockchain covert channels have higher reliability and concealment compared to traditional network-based covert channels. However, existing blockchain covert storage channels need to create a large number of transactions to transmit covert information. Creating transactions requires a transation fee, which means that the implementation of blockchain covert storage channels requires a high cost. Besides, created transactions remain on-chain permanently, leading to the threat of covert information being detected. To overcome these limitations, we propose a blockchain covert timing channel framework. Specifically, we utilize inv and getdata messages in the Bitcoin transaction broadcast as carriers and propose three modulation modes to achieve covert channels without cost and leaving no trace. We evaluate the concealment of our modes by K-S, KLD tests, and machine learning approaches. Experimental results show the indistinguishability between traffic carrying covert information and normal traffic. Our channels promise a capacity of 2.4 bit/s.

Generic and Sensitive Anomaly Detection of Network Covert Timing Channels

Network covert timing channels can be maliciously used to exfiltrate secrets, coordinate attacks and propagate malwares, posing serious threats to cybersecurity. Current covert timing channels normally conduct small-volume transmission under the covers of various disguising techniques, making them hard to detect especially when a detector has little priori knowledge of their traffic features. In this paper, we propose a generic and sensitive detection approach, which can simultaneously (i) identify various types of channels without their traffic knowledge and (ii) maintain reasonable performance on small traffic samples. The basis of our approach is the finding that the short-term timing behavior of covert and legitimate traffic is significantly different from the perspective of inter-packet delays' variation. This phenomenon can be a generic reference to detect various channels because it is resistant to major channel disguising techniques which only mimic long-term traffic features, while it is also a sensitive reference to spot small-volume covert transmission since it can capture traffic anomalies in a fine-grained manner. To obtain the inner patterns of inter-packet delays' variation, we design a context-sensitive feature-extraction technique. This technique transforms each raw inter-packet delay into a discrete counterpart based on its contextual properties, thus extracting its variation features and reducing traffic data complexity. Then we learn legitimate variation patterns using a neural network model, and identify samples showing anomalous variation as covert. The experimental results show that our approach effectively detects all currently representative channels in the absence of their knowledge, presenting once to twice higher sensitivity than the state-of-the-art solutions.

Performance Assessment and Mitigation of Timing Covert Channels over the IEEE 802.15.4

The fast development and adoption of IoT technologies has been enabling their application into increasingly sensitive domains, such as Medical and Industrial IoT, in which safety and cyber-security are paramount. While the number of deployed IoT devices increases annually, they still present severe cyber-security vulnerabilities, becoming potential targets and entry points for further attacks. As these nodes become compromised, attackers aim to set up stealthy communication behaviours, to exfiltrate data or to orchestrate nodes in a cloaked fashion, and network timing covert channels are increasingly being used with such malicious intents. The IEEE 802.15.4 is one of the most pervasive protocols in IoT and a fundamental part of many communication infrastructures. Despite this fact, the possibility of setting up such covert communication techniques on this medium has received very little attention. We aim to analyse the performance and feasibility of such covert-channel implementations upon the IEEE 802.15.4 protocol, particularly upon the DSME behaviour, one of the most promising for large-scale time critical communications. This enables us to better understand the involved risk of such threats and help support the development of active cyber-security mechanisms to mitigate these threats, which, for now, we provide in the form of practical network setup recommendations.

Improving Performance of Virtual Machine Covert Timing Channel Through Optimized Run-Length Encoding

Improving Performance of Virtual Machine Covert Timing Channel Through Optimized Run-Length Encoding

A deep learning approach for detecting covert timing channel attacks using sequential data

A deep learning approach for detecting covert timing channel attacks using sequential data

Characterization and Detection of Cross-Router Covert Channels

In covert channel attacks, an adversary seeks various means to influence a tangible characteristic of a system, and then makes the systems leak information by measuring this characteristic. Covert channels are, by nature, very elusive. This makes it very difficult to identify them and defend against attacks that use these channels to leak sensitive information. Thus, they are a serious threat to the security of many systems.In this paper, we present two network timing covert channel attacks, and a defense mechanism against them. The purpose of the proposed attacks is to leak sensitive information between two logically separated (or isolated) networks that are hosted by a single router – one that is connected to the Internet, and another that is isolated and contains sensitive information. The attacks build on the fact that the response time of the router for a specific type of packet sent from a device that is connected to it is usually predictable, given the network topology. By interacting with the single shared router in a specific manner, an attacker can increase the router’s packet response time. The interaction is determined based on the information to be leaked, so the receiver (a computer located on the Internet-connected network) can measure the delayed packet response times and decode the sender’s signals (which operates from the isolated network) to receive classified information. The two classes of attacks presented in this work differ in the way that the delay is caused. In the cross-router covert channel (CRCC) attack, the sender overloads the router with control-plane packets; in the Wi-Fi micro-jamming attack, the sender uses a pre-installed implant to transmit single-tone signals in the 2.4GHz frequency range, disturbing the router’s packet transmissions. We showed that both attacks can influence a wide range of router brands and Wi-Fi capable devices and evaluated the optimal settings for both attacks when using different types of packets, transmission power, and data transmission rates.Our proposed defense mechanism is based on semi-supervised machine learning and deep learning algorithms, which are both used for novelty detection in network traffic. By detecting unusual traffic, we can identify the disturbances needed to leak the information. The system can then respond by blocking the suspicious devices that are involved in the attack. We evaluated the attacks in noisy and noise-free environments, successfully detecting both attacks in both environments. All the data and code, which includes the implementation of the attacks and the defense mechanism, is published as a benefit to the research community.

Practical Covert Wireless Unidirectional Communication in IEEE 802.11 Environment

Covert communications, or covert channels, are commonly exploited to establish a data exfiltration channel from an insider on a trusted network to a malicious receiver outside the network without using normal communication of the network. It is because the malicious receiver is an unauthorized user of the communication network and so he cannot communicate with any entity in the network. In this study, we construct a new covert wireless unidirectional communication mechanism in an IEEE 802.11 environment. Our covert communication is based on a covert timing channel exploiting the beacon interval of a given commercial-like AP. Because the wireless covert channel we proposed can be implemented only with firmware modification to the WLAN MAC protocol, it is very suitable for application in a real public AP environment. In order to dramatically reduce the chance of covert signals being detected by others, a new and simple covert data encoding scheme, called ping-pong covert timing channel (PPCTC), is proposed, and we show that the covertness of the PPCTC is excellent compared to the previous timing-based covert channels. Although this wireless covert communication is unidirectional communication, since PPCTC has recovery characteristics against consecutive 2-bit errors, stable communication is guaranteed. Furthermore, a covert frame structure is presented for providing the confidentiality and integrity of the information transmitted via our covert channel. To the best of our knowledge, this is the first attempt.

TPPD: Targeted Pseudo Partitioning based Defence for cross-core covert channel attacks

Contemporary computing employs cache hierarchy to fill the speed gap between processors and main memories. In order to optimise system performance, Last Level Caches (LLC) are shared among all the cores. Cache sharing has made them an attractive surface for cross-core timing channel attacks. In these attacks, an attacker running on another core can exploit the access timing of the victim process to infiltrate the secret information. One such attack is called a cross-core Covert Channel Attack (CCA). Timely detection and then prevention of cross-core CCA is critical for maintaining the integrity and security of users, especially in a shared computing environment. In this work, we have proposed an efficient cross-core CCA mitigation technique. We propose a way-wise cache partitioning on targeted sets, only for the processes suspected to be attackers. In this way, the performance impact on the entire LLC is minimised, and benign applications can utilise the LLC to its full capacity. We have used a cycle-accurate simulator (gem5) to analyse the performance of the proposed method and its security effectiveness. It has been successful in abolishing the cross-core covert timing channel attack with no significant performance impact on benign applications. It causes 23% less cache misses in comparison to existing partitioning based solutions while requiring ≈0.26% storage overhead.

An efficient VoLTE covert timing channel for 5 G networks: RDCTC

Covert Channels are necessary to protect the privacy of individuals as well as to obtain confidentiality to governmental and military agencies. A novel covert timing channel is proposed with three main improvements over the existing ones: Reorder Density (RD) metric-based packet reordering that reduces exposure, introducing Modified Turbo Code (MTC) for efficient encoding, and Discrete Haar Wavelet Transform (DHWT) that increases channel reliability. A threat model is proposed and shown to be inefficient to effectively meet covert channel properties against network jitter, noise, and curious attackers that try to identify a channel exists. Run and test is applied to investigate randomness of the proposed covert channel. The proposed covert channel is adoptable to 5 G VoLTE networks. These proposed strategies significantly improve the robustness while also minimizing the detectability of covert channels in VoLTE.

A typical analysis of hybrid covert channel using constructive entropy analytics

<p><span>A covert timing channel is based on modulation of the timing information in the network packets in a secured communication. The delicacy of this channel is primarily viewed as single coherent channel thwart the detection from any third-party entity or network admin. The timing covert channel is strenuous to detect under many scenarios due to the intricate complexity of the channel. The exploration of timing covert channel shed light on intrinsic design aspects which elevate understanding to an advanced level. This will effectively bring out elite literature aspects of the timing covert channel for seamless implementation. Supraliminal channels are innocuous message-based channel introduced as a trapdoor in the communication system either intentional or as vulnerability of the system. A hybrid covert channel is the existence of homogeneous or heterogeneous network covert channel variants either at same instant or at different instant of time. For instance, one of possible hybrid covert channel is the co-existence of timing covert channel in transmission control protocol (TCP) and supraliminal channel in voice over internet protocol (VoIP). This paper introduces this variant of the hybrid covert channel and their significance in network communication. The paper also refers to standard measures-entropy, covertness index to understand hybrid covert channel.</span></p>

A robust packet‐dropping covert channel for mobile intelligent terminals

Covert communication in this regard has been widely used for protecting the secrecy of communication. Voice over Long Term Evolution (VoLTE) is a packet-switched core network solution for high-speed and high-quality end-to-end services which usually applied to the communication between intelligent systems. However, covert channels using inter-packet delays and packet order in VoLTE services are limited by specific rules. Since minor modifications to overt traffic can be detected, existing covert channel solutions cannot be directly applied to VoLTE. Therefore, this study presents a robust packet loss covert timing channel by cascade hash coding with intelligent system. To ensure robustness and undetectability, we design hash-based inter-codeword verification, codeword self-verification based on cyclic redundancy check, and adaptive mapping matrix. The sender modulates the covert messages according to the sequence number of the actively dropped packets, and the receiver can retrieve the covert messages using a specialized verification method. To evaluate undetectability, robustness, throughput, and construction costs, a large number of experiments in mobile intelligent terminals have been conducted. The experimental results prove that the proposed scheme is feasible for VoLTE communication, as the covert message is shown to be transmitted secretly, and the bit error and throughput are within acceptable ranges.

ОГРАНИЧЕНИЕ ПРОПУСКНОЙ СПОСОБНОСТИ СЕТЕВЫХ СКРЫТЫХ КАНАЛОВ ПО ВРЕМЕНИ ПУТЕМ ВВЕДЕНИЯ ДОПОЛНИТЕЛЬНЫХ СЛУЧАЙНЫХ ЗАДЕРЖЕК ПЕРЕД ОТПРАВКОЙ ПАКЕТА

Attention to covert channels has largely increased due to the documents published by E. Snowden, which described the software and hardware embedding that implement undeclared features of covert information transfer in the Huawei and Juniper network equipment, Apple mobile phones and computers with the Windows XP operating system. A covert channel can be built using any information technology, but often attackers build covert channels in IP networks, since they are widespread, have a high information transfer rate, and ubiquitous information security measures, such as traffic encryption, do not affect the possibility of covert transmission of information via some types of such channels. The limitation of their bandwidth is a promising direction for countering information leakage via network covert channels. This study considers network timing covert channels, provides a method for assessing their capacity, proposes and investigates a way to counter information leakage via such covert channels by introducing noise having added delays before sending packets. The values of the delays are distributed in two different ways: uniformly and according to distribution with a decreasing probability density function. As an experiment, the temporal characteristics of IP traffic from a host in the internal network to a public service were obtained, which were used to verify the obtained methods for assessing the covert channel capacity. A distinctive feature of the calculations is an illustration of the possibility to minimize the load on the communication channel in the context of introducing a countermeasure method, as well as taking into consideration the fact that the intruder's ability to observe the current conditions in the network allows him to adjust the parameters of information transfer to the load in the communication channel, thereby maintaining the maximum possible covert channel bandwidth.

ZM-CTC: Covert timing channel construction method based on zigzag matrix

VoLTE (Voice over Long-Term Evolution) is a widely used, high-performance, and end-to-end transmission solution in 4G and 5G. However, it also provides a new foundation for the CTC (covert timing channel), which transmits data in a hidden way. Because the packet type, transmission sequence, and transmission jitter in VoLTE have the strong regularity, it is challenging to build CTC. In this paper, a CTC construction method based on zigzag matrix named ZM-CTC is proposed to establish a connection between the codewords and dropped packets in a nonlinear rule. Moreover, a random salt and a random field in VoLTE are introduced to enhance the undetectability of ZM-CTC. The experimental results show that the ZM-CTC with 9 bits codeword could keep a balance among the undetectability, the robustness, the throughput, and the construction cost. The throughput of CTC is 0.88 bps, and the bit error rate of CTC is less than 1.5%.

Timing covert channel analysis of the VxWorks MILS embedded hypervisor under the common criteria security certification

Virtualization technology is nowadays adopted in security-critical embedded systems to achieve higher performance and more design flexibility. However, it also comes with new security threats, where attackers leverage timing covert channels to exfiltrate sensitive information from a partition using a trojan. This paper presents a novel approach for the experimental assessment of timing covert channels in embedded hypervisors, with a case study on security assessment of a commercial hypervisor product (Wind River VxWorks MILS), in cooperation with a licensed laboratory for the Common Criteria security certification. Our experimental analysis shows that it is indeed possible to establish a timing covert channel, and that the approach is useful for system designers for assessing that their configuration is robust against this kind of information leakage.

Robust authentication for automotive control networks through covert channels

Automotive control networks offer little resistance against security threats that come with the long-range connectivity in modern cars. Remote attacks that undermine the safety of vehicles have been shown to be practical. A range of security mechanisms have been proposed to harden resource-constrained embedded microcontrollers against malicious interference, including cryptographic protocols that establish the authenticity of in-vehicle message exchange. However, authenticated communication comes with repercussions on deployability and vehicle safety in terms of reliability, real-time compliance, backwards compatibility, and bandwidth and resource use.In this article we investigate benign, defencive uses of covert channels to implement and support vehicular message authentication mechanisms as a transparent, resource-conserving approach to automotive network security. We provide the first comprehensive evaluation of covert channels in Controller Area Networks (CAN) with respect to the attainable bandwidth and reliability of covert communication. Our analysis identifies timing-based covert channels as candidates to design a complementary nonce synchronisation channel that can enhance robustness against message loss in existing authentication schemes. We practically implement and evaluate this design on top of an open-source authenticated CAN communication library, showing that covert timing channels can improve communication robustness in benign circumstances, while not reducing the security guarantees of the underlying authentication primitives when under attack.

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.