Covert Channel Detection Method Based On Clustering And Differentiation Of The Network Time

Network covert channel is an important branch of network information security field. It is a kind of covert channel which is constructed by network resources in network system which can carry out communications by violating the normal rules of Internet. So it can be used to leak and transmit sensitive information privately. It takes serious threat to net work information security. Network covert timing channel is one kind of network covert channels. It is often constructed by transmit rate or interval time of network packets. Along with the rapid development of Internet, there are more and more Internet applications and some hackers can steal confidential information by combining network covert channel with Trojan technology. Therefore, it is significant to research the detection technology of network covert channel.Network covert channel is becoming more and more important along with the popularization of Internet. There are some methods in constructing and detecting the network covert timing channel. But these detect methods have some defect. Some methods are designed to target one specific covert timing channel, and therefore, fail to detect other types of covert timing channels and have no universality in detection target. And the other methods which can detect some kinds of covert channels are dependent on the Probability Statistics. The statistics methods are dependent on the network environment, so these detect methods can't work in different network environment and have no universality in environment.This paper in view the existing shortage of detect methods, by researching some existing construct and the detect methods of network covert timing channel, proposes a new universal detect method of network covert timing channel which bases on clustering and polarization characteristics and it can detect some different kinds of covert timing channels and can acclimatize different network environment. This paper discusses the principle, model and algorithm of this method also contains analysis and design in detail. At last we implement a detector on Windows and verify the proposed detect availability by experiments.