Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

One Countermeasure, Multiple Patterns: Countermeasure Variation for Covert Channels

: Wendzel, Steffen; Eller, Daniela; Mazurczyk, Wojciech


Association for Computing Machinery -ACM-:
CECC 2018, Central European Cybersecurity Conference. Proceedings : Ljubljana, Slovenia, November 15 - 16, 2018
New York: ACM, 2018
ISBN: 978-1-4503-6515-4
Art. 1, 6 S.
Central European Cybersecurity Conference (CECC) <2018, Ljubljana>
Fraunhofer FKIE ()

Network covert channels enable stealthy communications for malware and data exfiltration. For this reason, the development of effective countermeasures for covert channels is important for the protection of individuals and organizations. However, due to the number of available covert channel techniques, it can be considered impractical to develop countermeasures for all existing covert channels.
In recent years, researchers started to develop countermeasures that (instead of only countering one particular hiding technique) can be applied to a whole family of similar hiding techniques. These families are referred to as hiding patterns.
The main contribution of this paper is that we extend the idea of hiding patterns by introducing the concept of countermeasure variation. Countermeasure variation is the slight modification of a given countermeasure that was designed to detect covert channels of one specific hiding pattern so that the countermeasure can also detect covert channels that are representing other hiding patterns.
We exemplify countermeasure variation using the compressibility score originally presented by Cabuk et al. The compressibility score is used to detect covert channels of the 'inter-packet times' pattern and we show that countermeasure variation allows the application of the compressibility score to detect covert channels of the 'size modulation' pattern, too.