By slightly changing packet timing, these schemes achieve robust correlation for encrypted network connections under timing perturbation. Timing-based active watermarking schemes are developed to trace back attackers through stepping stone connections or anonymizing networks. TheĮxperimental results show that model-based covert timing channels provide a significant increase in detection resistance with To validate the effectiveness of the proposed framework, we conduct a series of experiments in LAN and WAN environments. The framework is lightweight, and the overhead induced by model fitting is negligible. Then, the encoder and transmitter use the model to generate covert trafficĪnd blend with legitimate network traffic. The filter characterizes the features of legitimate network traffic, and the analyzerįits the observed traffic behavior to a model. Our framework consists of four main components: filter,Īnalyzer, encoder, and transmitter. We design and implementĪn automated framework for building model-based covert timing channels. The statistical properties of legitimate network traffic to evade detection in an effective manner. In this paper, we introduce a new class of covert timing channels, called model-based covert timing channels, which exploit The exploration of advanced covert timing channel design is important to understand and defend against covert timing channels. The Stealth method also successfully evades shape-based detection tests but is vulnerable to regularity-based tests. The Stealth method uses Reed-Solomon forward error correction to reduce bit errors from 3.1% to nearly 0% with minimal additional overhead.

The Throughput method exfiltrates covert data at nearly 800 bits per second (bps) compared to 18 bps with the Baseline method and 0.13 bps for the Stealth method. Effectiveness of these scenarios is empirically tested using public IRC servers in Chicago, Illinois and Amsterdam, Netherlands. Three methods for concealing information are developed under this framework to suit an attacker's needs - maximise channel capacity, minimise shape-based detectability, or provide a baseline for comparison using established techniques applied to IRC. We introduce a framework for information hiding techniques for use over IRC, called VANISH-Variable Advanced Network IRC Stealth Handling System. Exploration of advanced information hiding techniques is important to defeat illicit file extractions over networks.

Mirc variables