Based On The Model Fitting And Fuzzy Clustering Network Covert Channel Detection Method Research

With the development of communication technology and computer science, the lives of people are getting more tied to the network. The rapid development of the Internet, electronic commerce and cloud computing bring great convenience, but also bring a lot of information security problems. The network covert timing channel sends confidential information by using the legitimate channel and changing the time when the packets are sent. The network covert channel is different from encryption technique; it does not directly send encrypted information, so it is hard for security systems to detect. Due to its characteristics, the network covert channel poses a great threat to information security.There are a lot of detection methods that have been put forward by domestic and overseas scholars. But all these methods have their limitations. Some methods can only detect one particular network covert timing channel, but they can do nothing to other network covert timing channels. Some other methods only can work in a specific network environment and they fail when the network environment is changed.This paper proposes a generic method which can detect all of the network covert timing channels. This paper creates a object library which includes different network environments, so it can adapt to different network environments. It will discuss the construction and characteristics of the network covert timing channel. Also, it states the reasons why the existing detection method is not versatile enough. It proposes a new detection method which is based on a model of fitting and fuzzy clustering. We will introduce the principle of this method, the selection of the parameters, channel object, channel distance and the process of this method. Then we implement a network timing covert channel detector and test it to verify the effectiveness and versatility of this method.