Detection of TCP covert channel based on Markov model

详细信息    查看全文

• 作者：Jiangtao Zhai (1)
  Guangjie Liu (1)
  Yuewei Dai (1)
  
• 关键词：TCP covert channel ; Markov model ; Covert channel detection ; MAP
• 刊名：Telecommunication Systems
• 出版年：2013
• 出版时间：November 2013
• 年：2013
• 卷：54
• 期：3
• 页码：333-343
• 全文大小：
• 作者单位：Jiangtao Zhai (1)
  Guangjie Liu (1)
  Yuewei Dai (1)
  
  1. School of Automation, Nanjing University of Science and Technology, 210094, Nanjing, P.R. China
  
• ISSN：1572-9451

文摘

Network covert channel is a covert communication method by hiding covert messages into overt network packets. In recent years, with the development of various hiding methods, network covert channel has become a new kind of threat for network security. The covert channel that uses the redundancies existing in TCP protocol to make hiding is called TCP covert channel. In this paper, the behaviors of TCP flows are modeled by the Markov chain composed of the states of TCP packets. And the abnormality caused by TCP covert channel is described by the difference between the overt and covert TCP transition probability matrix. The detection method based on MAP is proposed to detect the covert communication hidden in TCP flows under various applications such as HTTP, FTP, TELNET, SSH and SMTP. Experiments show that the proposed algorithm achieves better detection performance than the existing methods.