Cabuk, Serdar Ph.D., Purdue University, December, 2006. Network Covert Channels: Design, Analysis, Detection, and Elimination. Major Professors: Carla E. Brodley and Eugene H. Spafford. Indirect communication channels have been effectively employed in the communications world to bypass mechanisms that do not permit direct communication between unauthorized parties. Such covert channels emerge a...

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messa...

A network covert channel violates security rules and leaks information imperceptibly. Many researchers have been studying how to construct it, and the basic methods involve exploiting packets head, packets sorting and packets timing, etc. To construct a more secret covert channel, this paper proposes a novel approach based on packet classification. With this method, covert information is encode...

Within the last years, new techniques for network covert channels arose, such as covert channel overlay networking, protocol switching covert channels, and adaptive covert channels. These techniques have in common that they rely on covert channel-internal control protocols (so called micro protocols) placed within the hidden bits of a covert channel’s payload. An adaptable approach for the engi...

The detection of covert channels in communication networks is a current security challenge. By clandestinely transferring information, covert channels are able to circumvent security barriers, compromise systems, and facilitate data leakage. A set of statistical methods called DAT (Descriptive Analytics of Traffic) has been previously proposed as a general approach for detecting covert channels...

Cloak is a new class of network covert timing channel relied on multilink with high reliability and enhanced data rate. The existing detection schemes are less effective to detect this kind of covert channel. In this paper, the detection method for Cloak covert channel based on burst size distribution is proposed. The statistical distribution of burst size is calculated and Chi-Squared test is ...

Covert channels are of two types: (a) timing channel and (b) storage channel. Most previous works have studied these channels from the encoder’s perspective, namely, information theoretic capacity, algorithms and protocols for hiding information etc. This paper investigates the covert channel problem from an passive adversary’s perspective. A sequential distinguisher for storage channel identif...

Covert channel is a major threat to the information system security and commonly found in operating systems, especially in cloud computing environment. Owing to the characteristics in cloud computing environment such as resources sharing and logic boundaries, covert channels become more varied and difficult to find. Focusing on those problems, this paper presents a universal method for detectin...

It is well known that security properties are not preserved by refinement, and that refinement can introduce new, covert, channels, such as timing channels. The finalisation step in refinement can be analysed to identify some of these channels, as unwanted finalisations that can break the assumptions of the formal model. We introduce a taxonomy of such unwanted finalisations, and give examples ...

Communication is not necessarily made secure by the use of encryption alone. The mere existence of communication is often enough to raise suspicion and trigger investigative actions. Covert channels aim to hide the very existence of the communication. The huge amount of data and vast number of different protocols in the Internet makes it ideal as a high-bandwidth vehicle for covert communicatio...