Detecting protocol switching covert channels

Search Swinburne Research Bank

Home

Please use this identifier to cite or link to this item: http://hdl.handle.net/1959.3/234781

Title: Detecting protocol switching covert channels
Author(s): Wendzel, Steffen; Zander, Sebastian
Abstract: Network covert channels enable hidden communication and can be used to break security policies. Within the last years, new techniques for such covert channels arose, including protocol switching covert channels (PSCCs). PSCCs transfer hidden information by sending network packets with different selected network protocols. In this paper we present the first detection methods for PSCCs. We show that the number of packets between network protocol switches and the time between switches can be monitored to detect PSCCs with 98-99% accuracy for bit rates of 4 bits/second or higher.
Publication type: Conference poster
Research centre: Swinburne University of Technology. Faculty of Information and Communication Technologies. Centre for Advanced Internet Architectures
Source: Proceedings of the 37th IEEE Local Computer Networks Conference (LCN 2012), Clearwater, Florida, United States, 22-25 October 2012, pp. 280-283
Publication year: 2013
Keyword(s): Covert channels; Network monitoring; Network operations
Publisher: IEEE
ISSN: 0742-1303 (series ISSN)
ISBN: 9781467315654
Publisher URL: http://dx.doi.org/10.1109/LCN.2012.6423628
Peer reviewed