Research On Network Time Covert Channel Detection Method Based On Recursive Quantitative Analysis

With the rapid development of information technology, people paid more and more attention to network security issues. One after another information leakage event reminds people to realize that network security situation is grim. Network covert timing channel is a kind of network covert channels with high covertness, and it can be an ideal way of information leakage, so it does serious harm to network security. Therefore, researching the detection technology is of great importance to solve network security issues.So far researchers have proposed many methods in detecting the network covert timing channels, which are almost based on linear analysis. However, network environment is a highly complex nonlinear system. It is defective to study the nonlinear problem with linear analysis method. On the one hand linear analysis method is hard to describe the characteristics of nonlinear systems, which leads to poor universal performance of detection method based on linear analysis, the detection method can generally only detect one specific network covert timing channel, the detection result is not ideal, even if the detection method can detect other network covert timing channels. On the other hand linear analysis method requires a linear hypothesis for nonlinear problem, which makes such methods relying on an extremely stable network environment, so it is difficult to apply in a real network environment. The entropy-based detection method is an effective universal method in detecting network covert timing channel, which can effectively detect the current typical covert channels. However, researchers then proposed the anti-entropy detection network covert timing channel, which is based on manipulating entropy.This paper studies the detection problem of network covert timing channel from the perspective of nonlinear analysis, and proposes a detection method based on recurrence quantification analysis. The recurrence quantification analysis method is an effective kind of nonlinear analysis methods, which can accurately describe the characteristics of nonlinear systems, thereby overcoming the defect of studying nonlinear problem with linear analysis method. The proposed method is universal and it can effectively detect several current typical network covert timing channels, including the network covert timing channel which is anti-entropy detection. In this paper, we explain the principle of detection method, and then describe the process of the detection method in detail. At last experiments show that the proposed detection method is effective.