Cooperative Covert Communication in Multi-Antenna Broadcast Channels

With the gradual popularization of 5G communications,the application of multi-antenna broadcasting technology has become widespread.Therefore,this study aims to investigate the wireless covert communication in the two-user cooperative multi-antenna broadcast channel.We focus on the issue that the deteriorated reliability and undetectability are mainly affected by the transmission power.To tackle this issue,we design a scheme based on beamforming to increase the reliability and undetectability of wireless covert communication in the multi-antenna broadcast channel.We first modeled and analyzed the cooperative multi-antenna broadcasting system,and put forward the target question.Then we use the SCA(successive convex approximation)algorithm to transform the target problem into a series of convex subproblems.Then the convex problems are solved and the covert channel capacity is calculated.In order to verify the effectiveness of the scheme,we conducted simulation verification.The simulation results show that the proposed beamforming scheme can effectively improve the reliability and undetectability of covert communication in multi-antenna broadcast channels.

Detecting DNS Covert Channels Using Stacking Model

A covert channel is an information channel that is used by the computer process to exfiltrate data through bypassing security policies.The DNS protocol is one of the important ways to implement a covert channel.DNS covert channels are easily used by attackers for malicious purposes.Therefore,an effective detection approach of the DNS covert channels is significant for computer systems and network securities.Aiming at the difficulty of the DNS covert channel identification,we propose a DNS covert channel detection method based on a stacking model.The stacking model is evaluated on a campus network and the experimental results show that the detection based on the stacking model can detect the DNS covert channels effectively.Besides,it can identify unknown covert channel traffic.The area under the curve(AUC)of the proposed method reaches 0.9901,which outperforms existing detection methods.

Analysis and Application of Covert Channels of Internet Control Message Protocol

Based on the analysis of the covert channel＇s working mechanism of the internet control message protocol （ICMP） in internet protocol version 4 （IPv4） and Internet Protocol version 6 （IPv6）, the ICMP covert channd＇s algorithms of the IPv4 and IPv6 are presented, which enable automatic channeling upon IPv4/v6 nodes with non-IPv4-compatible address, and the key transmission is achieved by using this channel in the embedded Internet terminal. The result shows that the covert channel＇s algorithm, which we implemented if, set correct, the messages of this covert channel might go through the gateway and enter the local area network.

Integrated criteria for covert channel auditing

A new concept, the security level difference of a covert channel, is presented, which means the security level span from the sender to the receiver of the covert channel. Based on this, the integrated criteria for covert channel auditing are given. Whereas TCSEC (Trusted Computer System Evaluation Criteria) or CC (Common Criteria for Information Technology Security Evaluation) only use the bandwidth to evaluate the threat of covert channels, our new criteria integrate the security level difference, the bandwidth sensitive parameter, bandwidth, duration and instantaneous time of covert channels, so as to give a comprehensive evaluation of the threat of covert channels in a multilevel security system.

A Distributed Covert Channel of the Packet Ordering Enhancement Model Based on Data Compression

Covert channel of the packet ordering is a hot research topic.Encryption technology is not enough to protect the security of both sides of communication.Covert channel needs to hide the transmission data and protect content of communication.The traditional methods are usually to use proxy technology such as tor anonymous tracking technology to achieve hiding from the communicator.However,because the establishment of proxy communication needs to consume traffic,the communication capacity will be reduced,and in recent years,the tor technology often has vulnerabilities that led to the leakage of secret information.In this paper,the covert channel model of the packet ordering is applied into the distributed system,and a distributed covert channel of the packet ordering enhancement model based on data compression(DCCPOEDC)is proposed.The data compression algorithms are used to reduce the amount of data and transmission time.The distributed system and data compression algorithms can weaken the hidden statistical probability of information.Furthermore,they can enhance the unknowability of the data and weaken the time distribution characteristics of the data packets.This paper selected a compression algorithm suitable for DCCPOEDC and analyzed DCCPOEDC from anonymity,transmission efficiency,and transmission performance.According to the analysis results,it can be seen that DCCPOEDC optimizes the covert channel of the packet ordering,which saves the transmission time and improves the concealment compared with the original covert channel.

Auditing the Use of DBMS Covert Storage Channels Relevant with Transactions

This paper proposes the concept of transaction-type covert storage channels, which are caused by database storage resources. It also proposes that the mode of auditing those channels be based on the transactions. Next, the paper analyzes and resolves the two problems arising from auditing the use of transaction-type covert storage channels in database systems: namely, the relationship between channel variables, which are altered (or viewed) by the transaction and satisfy integrity constraints in DBMS, and database states; and the circumvention of covert storage channel audit in DBMS.

Inaudible Sound Covert Channel with Anti-Jamming Capability: Attacks vs. Countermeasure

When an inaudible sound covert channel(ISCC)attack is launched inside a computer system,sensitive data are converted to inaudible sound waves and then transmitted.The receiver at the other end picks up the sound signal,from which the original sensitive data can be recovered.As a forceful countermeasure against the ISCC attack,strong noise can be used to jam the channel and literally shut down any possible sound data transmission.In this paper,enhanced ISCC is proposed,whose transmission frequency can be dynamically changed.Essentially,if the transmitter detects that the covert channel is being jammed,the transmitter and receiver both will switch to another available frequency and re-establish their communications,following the proposed communications protocol.Experimental results show that the proposed enhanced ISCC can remain connected even in the presence of a strong jamming noise source.Correspondingly,a detection method based on frequency scanning is proposed to help to combat such an anti-jamming sound channel.With the proposed countermeasure,the bit error rate(BER)of the data communications over enhanced ISCC soars to more than 48%,essentially shutting down the data transmission,and thus neutralizing the security threat.

Real-Time Timing Channel Detection in a Software-Defined Networking Virtual Environment

Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection approaches use either signature-based approaches to detect known TCs or anomaly-based approach by modeling the legitimate network traffic in order to detect unknown TCs. Un-fortunately, in a software-defined networking (SDN) environment, most existing TC detection approaches would fail due to factors such as volatile network traffic, imprecise timekeeping mechanisms, and dynamic network topology. Furthermore, stealthy TCs can be designed to mimic the legitimate traffic pattern and thus evade anomalous TC detection. In this paper, we overcome the above challenges by presenting a novel framework that harnesses the advantages of elastic re-sources in the cloud. In particular, our framework dynamically configures SDN to enable/disable differential analysis against outbound network flows of different virtual machines (VMs). Our framework is tightly coupled with a new metric that first decomposes the timing data of network flows into a number of using the discrete wavelet-based multi-resolution transform (DWMT). It then applies the Kullback-Leibler divergence (KLD) to measure the variance among flow pairs. The appealing feature of our approach is that, compared with the existing anomaly detection approaches, it can detect most existing and some new stealthy TCs without legitimate traffic for modeling, even with the presence of noise and imprecise timekeeping mechanism in an SDN virtual environment. We implement our framework as a prototype system, OBSERVER, which can be dynamically deployed in an SDN environment. Empirical evaluation shows that our approach can efficiently detect TCs with a higher detection rate, lower latency, and negligible performance overhead compared to existing approaches.

基于OSPF协议Hello报文隐蔽信道构建研究

现有存储型网络隐蔽信道的研究主要根据不同协议中不同字段来隐藏信息。在众多协议中,例如TCP、UDP协议,对其研究较多,而OSFP使用广泛却在国内研究较少。针对OSPF协议下的Hello报文进行分析可以构建网络隐蔽信道的字段。从所有可能字段中选择Authentication、Router Dead Interval和Neighbor三个字段分别使用随机值模式、值调制模型和序列模式进行构建三种隐蔽信道,利用微协议技术优化信道,并将三种隐蔽信道组合成一个传输速率更高的隐蔽信道模型。经过验证,该模型具有一定的可行性和隐蔽性,可为存储型网络隐蔽信道构建技术提供一定的理论支持和技术支撑。

处理器时间侧信道攻防技术综述

现代处理器优化机制众多,设计人员在追求性能提升时,往往忽略背后的安全风险。时间侧信道攻击因其影响面广且隐蔽性好已成为最主要的安全威胁之一。随着瞬态执行攻击的出现,时间侧信道攻击的能力被进一步扩展,计算系统的安全基础被动摇。为此,处理器厂商及安全人员提出了大量防御机制。这些机制具有不同的防护能力及性能开销。与此同时,新的瞬态执行漏洞和隐蔽信道也不断被发现,已提出的防御机制被不断突破。围绕处理器时间侧信道攻防技术的博弈日益激烈。本文从基本攻击原理出发,对现有时间侧信道攻击进行了归纳总结,并在此基础上进一步分析了相关防御机制的保护能力和性能瓶颈,从而梳理出时间侧信道攻防技术的发展趋势,为未来软硬件系统开发和安全技术探索提供参考。

全双工接收机辅助的星地隐蔽信息时效性分析

在现代通信技术不断发展的背景下,卫星通信在全球范围内的信息传输中扮演着至关重要的角色,然而,通信的安全性和信息的时效性始终是亟待解决的关键问题。以卫星—地面系统中隐蔽通信的信息新鲜度问题作为研究对象,该系统由卫星发射器Alice、地面全双工接收机Bob以及地面监听者Willie组成。在这种通信系统中,Alice在Willie的监测下尝试向Bob传输隐蔽信息,而Bob则发射干扰信号以混淆Willie,确保通信的隐蔽性。为此,首先针对Bob的平均信息时效性(AgeofInformation,AoI)和Willie的隐蔽约束进行了详细的理论建模。该模型考虑了通信过程中各类干扰和噪声的影响,从而为分析系统性能提供了坚实的理论基础。基于所建立的理论模型,进一步推导出了Alice在隐蔽性要求约束下的最优发射功率,以实现平均AoI的最小化。通过优化发射功率,Alice能够在保证隐蔽通信的前提下最大限度地提高信息的新鲜度,即尽量减少信息传输的延迟。随后,进行了数值模拟,验证了理论模型的准确性,并分析了发射功率和干扰功率对隐蔽性和平均AoI的影响。数值结果显示,通过合理调整发射和干扰功率,可以有效地在隐蔽性和信息时效性之间取得平衡。

区块链环境下隐蔽信道研究综述

隐蔽信道是将信息隐藏在公开的通信信道中进行隐蔽传输的方法,旨在保证数据传输的安全性,使第三方对隐蔽通信的过程毫无察觉。然而,随着流量分析技术的不断进步,传统的网络隐蔽信道已经无法保证其安全性。区块链作为一种新兴技术,结合了密码学、共识算法和P2P网络,具有去中心化、可追溯性、匿名性、不可变性和安全性等特性,成为了构建隐蔽信道的理想平台。首先,简要介绍了区块链技术,对隐蔽信道的发展历程进行了阐述,并对隐蔽信道现有的分类方式进行了研究和总结;然后,在传统网络隐蔽信道的基础上总结了区块链隐蔽信道的一般模型,将隐蔽信道的构建过程划分为信息传输和信息提取两个主要环节;接着,从区块链的六层架构出发,对区块链隐蔽信道进行了深入分析,按照不同的层次将区块链隐蔽信道分为了六大类,并依据每层的结构和机制进行细分,能够更好地理解区块链隐蔽信道的构建过程,挖掘潜在的隐蔽信道;最后,讨论了区块链技术给隐蔽信道带来的局限性,并提出了未来的研究方向。

网络隐蔽通道构建关键技术研究综述

网络隐蔽通道是指在网络环境下用于传输秘密信息的通道。传统网络隐蔽通道的构建主要基于信息内容隐写技术,而目前该领域的研究正逐渐转向通过隐蔽网络通信架构完成隐蔽传输。梳理了当前网络隐蔽通道构建研究领域的主流技术,总结了各网络层次隐蔽通道的构建技术,介绍了新型网络隐蔽通道,包括流媒体、区块链和IPv6,填补了现有工作的空白,为随后在这些新网络环境中设计隐蔽通道提供了研究思路。最后,提出了隐蔽通道构建面临的主要挑战,一是封锁技术降低了通道的可用性,二是使用机器学习和深度学习技术使得隐蔽通道更易被攻击,并指出了技术上的解决方向。

HMM特征提取结合感知哈希匹配的网络时间隐蔽信道检测

针对传统网络隐蔽信道检测识别率低和鲁棒性差的问题,利用正常信道和隐蔽信道在网络流量时间序列特性的差异,提出一种隐马尔科夫链(HMM)和感知哈希匹配的网络隐蔽信道检测方法。实验表明:所提方法能准确检测隐蔽信道的网络流量,且整体区分水平在70%~85%之间;在信号噪声干扰下能够保持较高的识别率,具有较好的鲁棒性;所提方法在感知特征提取花费的时间要明显少于传统的频谱域感知特征提取,且复杂度低。

隐蔽信道研究

隐蔽信道是指允许进程以危害系统安全策略的方式传输信息的通信信道,是对安全信息系统的重要威胁,并普遍存在于安全操作系统、安全网络、安全数据库系统中.国内外的安全标准都要求对高等级的安全信息系统进行隐蔽信道分析.首先分析隐蔽信道的基本概念,研究领域、技术组成及分类,然后从信道识别、度量、消除、限制、审计和检测几个技术层面综述隐蔽信道研究中经典的技术和方法,系统地总结隐蔽信道领域30多年来的研究成果,尤其对近年来隐蔽信道度量和处置新技术作了较为详尽的介绍.试图为该研究方向勾画出一个较为全面和清晰的概貌,为隐蔽信道分析领域的研究者提供有益的参考.

网络隐蔽信道关键技术研究综述

网络隐蔽信道是在网络环境下违反通信限制规则进行隐蔽信息传输的信息通道,为网络信息安全带来了新的挑战,也为数据传输的安全性和隐私性带来了新的研究方向.首先介绍了网络隐蔽信道的定义、分类、能力维度等基本概念;进而从码元设计、信息编码和信道优化这3个方面归纳分析了存储型和时间型两类网络隐蔽信道的构建技术,从隐蔽性、鲁棒性和传输效率这3个方面总结了网络隐蔽信道评估方法,从消除、限制、检测这3个方面梳理了网络隐蔽信道的对抗技术;最后,对未来的研究方向进行了展望.

隐蔽信道新型分类方法与威胁限制策略

隐蔽信道是指恶意通信双方通过修改共享资源的数值、特性或状态等属性,来编码和传递信息的信道.共享资源的选取,由隐蔽信道的类型与具体通信场景所决定.早期,存储隐蔽信道和时间隐蔽信道主要存在于传统操作系统、网络和数据库等信息系统中.近年来,研究重点逐渐拓展到了3类新型隐蔽信道,分别为混合隐蔽信道、行为隐蔽信道和气隙隐蔽信道.对近年来国内外隐蔽信道研究工作进行了系统的梳理、分析和总结.首先,阐述隐蔽信道的相关定义、发展历史、关键要素和分析工作.然后,根据隐蔽信道共享资源的类型以及信道特征,提出新的隐蔽信道分类体系.首次从发送方、接收方、共享资源、编码机制、同步机制、评价指标和限制方法这7个方面,对近年来新型隐蔽信道攻击技术进行系统的分析和归纳,旨在为后续隐蔽信道分析和限制等研究工作提供有益的参考.进而,讨论了面向隐蔽信道类型的威胁限制技术,为设计面向一类隐蔽信道的限制策略提供研究思路.最后,总结了隐蔽信道中存在的问题和挑战.

语音隐藏的研究及实现

本文提出了一种基于伪装式信息隐藏安全技术的语音信息隐藏电话（SIHT）系统的研究和实现方法。给出了语音信息隐藏的模型,并进行了模拟仿真。SIHT采用基于DSP的嵌入式技术设计了相应的功能模块。它可以利用普通的模拟电话线路,经过公共电话交换网络（PSTN）,在不引起人们注意的普通通话中,通过系统建立的一条隐秘信道将保密信息顺利地传递到接收方。实验证明,SIHT可以在保证语音质量的条件下实现实时语音信息隐藏保密通信的功能。

一种基于Web的可靠网络隐蔽时间信道的研究

针对隐蔽时间信道在广域网上无法稳定工作的问题,提出了一种可靠隐蔽时间信道的模型.这种信道利用HTTP协议的网络包的时间间隔作为载体传输隐蔽信息.通过抗干扰处理、接收方确认等方法,设计了可靠的通信协议.采用队列理论对这种可靠隐蔽时间信道进行建模,并推导出了该信道的容量.为了获取该信道的性能指标,在Internet网络中实现了这种可靠隐蔽时间信道,进行了隐蔽信息的数据传输实验.实验结果表明,这种可靠隐蔽时间信道的传输率约为传统隐蔽时间信道的传输率的11倍,在相同的干扰下,可靠隐蔽时间信道的稳定性远好于传统的隐蔽时间信道.

区块链环境下的新型网络隐蔽信道模型研究

区块链是随着数字货币商品兴起的去中心化基础架构,具有安全可信、顽健性高等特点。首次提出区块链环境下的网络隐蔽信道模型,具有抗干扰性、抗篡改性、多线路通信性、接收方匿名性、线路无关性,可以克服现有网络环境下的隐蔽信道特性缺陷等弊端。首先提出了区块链网络隐蔽信道模型,用形式化方法建模并证明了抗干扰性和抗篡改性;其次构建了基于业务操作时间间隔的区块链网络隐蔽信道的场景;最后提出了包含抗检测性、顽健性、传输效率的区块链网络隐蔽信道评估向量,为基于区块链环境的新型网络隐蔽信道的实用化奠定了理论基础。