Collaborative detection of Covert Storage Channels

This paper describes a new collaborative approach to detect two different types of Covert Storage Channels (CSCs) that utilize TCP flag and packet sequence number in network packets. Tested in Software-defined networking (SDN), a multistage detection mechanism coordinates monitors, correlators and SDN controllers to first quickly alert traffic anomalies, then to conduct on demand selective deep-inspection of network packets to reduce false alerts, and finally to reveal CSCs and conspirators as needed. SDN provides a test-bed of novel network configuration and applications to make it easier to access and inspect network traffic and manages the network in a flexible and dynamic fashion. The paper presents results from our experimentation of this approach on Mininet, an SDN simulation environment.