Research On Network Covert Timing Channel Detection Technology Based On Two-dimensional Image Mapping

Along with the development of network technology,more and more attention has been paid to the security of network information transmission.On the one hand,we need to detect and block the malicious information transmitted through the network;on the other hand,we need to ensure the security and privacy of the normal communication information transmitted through the network.Network covert timing channel detection is an important topic in this field.There are many problems in the previous network covert channel detection algorithms,many detection algorithms are effective for some specific covert channels,but the detection effect for other types of covert channels is not ideal,and the real-time and accuracy of detection need to be improved.Firstly,the paper studies and analyzes the existing detection methods of network covert channel,and analyzes the packet characteristic distribution of several typical network covert channel.In view of the defect that the existing detection methods only reflect the one-dimensional characteristics of the network covert channel,a detection method of the network covert timing channel based on the two-dimensional image characteristics is proposed.In order to further improve the accuracy of network covert channel detection,based on the above methods,a kind of network covert timing channel detection method based on convolutional neural network(CNN)is proposed.The main research work of this paper is as follows:(1)A detection method of network covert timing channel based on two-dimensional image features is proposed.By extracting two feature components of network packet time interval and packet length,and normalizing the values of the two feature components,a two-dimensional image that can describe the characteristics of network flow packet is constructed,so as to reflect the characteristics of network flow packet on one-dimensional time axis On the texture characteristics of two-dimensional image,the texture characteristics of two-dimensional image are analyzed by gray level co-occurrence matrix and its statistical characteristics,and then the legal channel and network covert timing channel are distinguished.Finally,the validity of the detection method is illustrated by the true positive rate and the false positive rate.(2)In this paper,a method of network covert timing channel detection based on convolutional neural network is proposed.The method realizes the detection of network covert timing channel by training and learning convolutional neural network on the basis of two-dimensional image of network packet feature components.In order to avoid the problem of parameter adjustment and over fitting,gradient descent and Dropout are used to optimize the training process.In order to test the effectiveness of the CNN based network covert timing channel detection method,are the the detection method is validated by using different types of network covert timing channel data sets.The influence of different parameters such as the number of training rounds and pooling mode on the detection results is analyzed,and the performance of other network covert timing channel detection methods is compared.The experimental results show that the method proposed in this paper has better detection ability.