Evaluation and Verification of Automated Covert Channel Modeling Using a Real Network Platform

In this paper we introduce and verify our Automated Covert Channel Modeling (ACCM) framework for evaluating and modeling covert channel algorithms. This work continues our efforts we reported at MILCOM 2013. Our ACCM framework is defined based on two different use cases: ACCM-Sim is designed to model covert channel algorithms in a simulation environment, whereas our ACCM-Net can be utilized to evaluate these algorithms in real network environments. In this paper we implement one of the most well-known and oft-cited Covert Timing Channel (CTC) algorithms, using the ACCM-Net and ACCM-Sim frameworks: N-bit to L-packet CTC. We introduce additional descriptor blocks that are incorporated into our previous ACCM-Sim and ACCM-Net framework library and verify their functionality and reliability to rapidly build a covert channel for simulation as well as for evaluation over real networks. Moreover, we demonstrate that the accuracy of covert data capacity obtained by the ACCM-Sim and ACCM-Net implementation is matching the expected theoretical values very closely. This proves that our ACCM framework is a general and reliable modeling tool for analyzing and evaluating covert channel algorithms.