Detection of Covert Timing Channel Based on Time Series Symbolization

Covert Timing Channels(CTCs) is a technique to leak information. CTCs only modify inter-arrival time sequence(IATs) between packets, consequently, traditional network security mechanisms, such as firewalls and proxies, can not effectively detect CTCs. If CTCs are maliciously utilized by criminals, will pose a great threat to network security. Classic CTCs detection methods, such as KS-test, Entropy-test, etc, not only have less universality and robustness, but also require more sampled IATs to detect CTCs, therefore, how to improve performance of detection methods against CTCs, has became a popular research in recent years. In this paper, a new CTCs detection method based on time series symbolization is proposed. It firstly converts the sampled IATs to symbolic time series, and regards each discrete value as a status. Then counts the times of transition for each status to status, and calculates the status transition probability matrix(STPM). Finally, it differentiates the label(overt or covert) of sampled IATs, by calculating similarity score. Experimental results about detection accuracy show that, in an ideal network environment, compared with classic methods, our method has better performance, with average accuracy of about 96%. Besides, our method has better performance as well, with the existence of network interference.