.png){kind=icon}
返回
Covert timing channel detection based on isolated binary trees
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.104200.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
As a communication method for concealing information, the covert network channel is often exploited for malicious purposes due to its inherently difficult-to-detect nature, posing potential risks to network security. In this paper, we propose a detection method based on isolated binary trees, aiming to address the problem of the novel covert channel imitating legitimate traffic patterns and injecting additional anomalies to evade detection. This method is based on the Isolation Forest algorithm, which can be classified into different categories by analyzing the stepwise function features of network traffic and using isolation binary trees generated with random split thresholds. At the same time, we validate the proposed detection model using a publicly available dataset. The experimental results demonstrate that eliminating outliers significantly enhances the stepwise function features while preserving the original form of legitimate traffic. Compared to the model without outlier handling, the average AUC scores for TRCTC and Jitterbug improved by 7.37% and 2.23%, respectively. Furthermore, we achieved superior performance on anew channel named epsilon-kappa clibur and epsilon-kappa clibur-O compared to using deep learning-based detection methods.
Keyword:
Covert timing channel
Stepwise function
Isolation forest
Outliers
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
分享收藏Covert timing channel detection method based on time interval and payload length analysis.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Using hierarchical statistical analysis and deep neural networks to detect covert timing channels使用层次统计分析和深度神经网络检测隐蔽定时通道
PREAI
分享收藏
查看更多内容