Weaknesses of popular and recent covert channel detection methods and a remedy

Abstract

Network covert channels are applied for the secret exfiltration of confidential data, the stealthy operation of malware, and legitimate purposes, such as censorship circumvention. In recent decades, some major detection methods for network covert channels have been developed. In this article, we investigate two highly cited detection methods for covert timing channels, namely $\epsilon$ε-similarity and compressibility score from Cabuk et al. (jointly cited by 949 articles and applied by several researchers). We additionally analyze two recent ML-based detection methods: GAS (2022) and SnapCatch (2021). While all these detection methods must be considered valuable for the analysis of typical covert timing channels, we show that these methods are not reliable when a covert channel's behavior is slightly modified. In particular, we demonstrate that when confronted with a simple covert channel that we call $\epsilon$ε-$\kappa$κlibur, all detection methods can be circumvented or their performance can be significantly reduced although the covert channel still provides a high bitrate. In comparison to existing timing channels that circumvent these methods, $\epsilon$ε-$\kappa$κlibur is much simpler and eliminates the need of altering previously recorded traffic. Moreover, we propose an enhanced $\epsilon$ε-similarity that can detect the classical covert timing channel as well as $\epsilon$ε-$\kappa$κlibur.