Search papers, labs, and topics across Lattice.
This paper introduces a hash-based covert carrier filtering strategy to enhance the security and covertness of network covert channels, which are critical for anti-censorship and data privacy. By implementing a key-dependent filtering rule, the method allows for dynamic selection of covert carriers, thereby increasing the randomness and making detection by adversaries more difficult. Experimental validation shows that this approach significantly improves detection resistance, particularly when the filter key size exceeds six bits, while maintaining low processing delays suitable for high-speed networks.
A novel filtering strategy can drastically enhance the stealth of network covert channels, making them far more resilient against detection.
As an effective anti-censorship mechanism, network covert channels can provide data privacy protection and ensure communication security. However, the covertness of existing network covert channels primarily depends on the secrecy of their covert algorithms. With the increasing depth of research in this field, the difficulty of breaking such algorithms has gradually decreased. Once the algorithm is exposed, the network covert channel can be easily detected by adversaries. To address this issue, this paper proposes a covert carrier filtering strategy based on the hash. In this strategy, a key-dependent filtering rule is introduced during the construction of the network covert channel, enabling the communicating parties to randomly and dynamically filter a sparse subset from the carrier set as the covert carrier set. This strategy not only enhances the randomness of carrier selection but also tightly couples the covertness of the network covert channel with the security of the key. We employ machine learning-based traffic analysis methods to experimentally validate the strategy in two types of network covert channels: network storage and timing covert channels. The experimental results demonstrate that the proposed strategy significantly improves the detection resistance of network covert channels. When the filter key size exceeds six bits, the impact on the detection effect of the classifier becomes quite significant. Furthermore, the processing delay for a single packet is less than 8 $\mu s$, indicating the feasibility of deploying the proposed strategy in high-speed network environments.
