Detection of Insertional Covert Channels Using Chi-square Test

Network covert channels can be used to transfer secret information in network protocols. For a kind of network covert channels hidden in overt sources with fixed probability distribution, we propose a modified Pearson chi-square test which improves detection accuracy. We incorporated adjacent probability values and divided the new distribution into two partitions sensitive to different hidden sections. In addition, given an overt source and different covert parameters, we can calculate the relation between covert capacity and detection probability. Advantages of the detection method are verified by an experiment using real network traffic data.