Description
The detection of covert channels has quickly become a vital need due to their pervasive nature and the increasing popularity of the Internet. In recent years, new and innovative methods have been proposed to aid in the detection of covert channels. Existing detection schemes are often too specific and are ineffective against new covert channels. In this paper, we expound upon previous work done with timing channels and apply it to detecting covert storage channels. Our approach is based on the assumption that the entropy of covert channels will vary from that of previously observed, legitimate, communications. This change in the entropy of a process provides us with a method for identifying storage channels. Using this assumption we created proof of concept code capable of detecting various covert storage channels. The results of our experiments demonstrate that we can successfully detect existing and unpublished covert storage channels accurately.
Date of creation, presentation, or exhibit
7-2012
Document Type
Conference Paper
Department, Program, or Center
Information Sciences and Technologies (GCCIS)
Recommended Citation
Sanders C., Valletta J., Yuan B., Johnson D., and Lutz P. Employing Entropy in the Detection and Monitoring of Network Covert Channels. In SAM'12 - The 2012 International Conference on Security and Management (Las Vegas, NV, USA, July 2012)
Campus
RIT – Main Campus
Comments
Presented at the 2012 International Conference on Security and Management, Las Vegas, NV, July 16-19.