Entry Cabuk:2009:ICC from tissec.bib

Last update: Sun Oct 15 02:58:48 MDT 2017                Valid HTML 3.2!

Index sections

Top | Symbols | Numbers | Math | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

BibTeX entry

@Article{Cabuk:2009:ICC,
  author =       "Serdar Cabuk and Carla E. Brodley and Clay Shields",
  title =        "{IP} Covert Channel Detection",
  journal =      j-TISSEC,
  volume =       "12",
  number =       "4",
  pages =        "22:1--22:29",
  month =        apr,
  year =         "2009",
  CODEN =        "ATISBQ",
  DOI =          "https://doi.org/10.1145/1513601.1513604",
  ISSN =         "1094-9224 (print), 1557-7406 (electronic)",
  ISSN-L =       "1094-9224",
  bibdate =      "Thu May 14 13:53:50 MDT 2009",
  bibsource =    "http://portal.acm.org/;
                 http://www.math.utah.edu/pub/tex/bib/tissec.bib",
  abstract =     "A covert channel can occur when an attacker finds and
                 exploits a shared resource that is not designed to be a
                 communication mechanism. A network covert channel
                 operates by altering the timing of otherwise legitimate
                 network traffic so that the arrival times of packets
                 encode confidential data that an attacker wants to
                 exfiltrate from a secure area from which she has no
                 other means of communication. In this article, we
                 present the first public implementation of an IP covert
                 channel, discuss the subtle issues that arose in its
                 design, and present a discussion on its efficacy. We
                 then show that an IP covert channel can be
                 differentiated from legitimate channels and present new
                 detection measures that provide detection rates over
                 95\%. We next take the simple step an attacker would of
                 adding noise to the channel to attempt to conceal the
                 covert communication. For these noisy IP covert timing
                 channels, we show that our online detection measures
                 can fail to identify the covert channel for noise
                 levels higher than 10\%. We then provide effective
                 offline search mechanisms that identify the noisy
                 channels.",
  acknowledgement = ack-nhfb,
  articleno =    "22",
  fjournal =     "ACM Transactions on Information and System Security",
  journal-URL =  "http://portal.acm.org/browse_dl.cfm?idx=J789",
  keywords =     "channel detection; information hiding; network covert
                 channels",
}

Related entries