Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy

Network covert channels are applied for the secret exfiltration of confidential data, the stealthy operation of malware, and legitimate purposes, such as censorship circumvention. In recent decades, some major detection methods for network covert channels have been developed. In this paper, we investigate two highly cited detection methods for covert timing channels, namely <tex-math notation="LaTeX">ε</tex-math> -similarity and compressibility score from Cabuk et al. (jointly cited by 930 papers and applied by thousands of researchers). We additionally analyze two recent ML-based detection methods: GAS (2022) and SnapCatch (2021). While all these detection methods must be considered valuable for the analysis of typical covert timing channels, we show that these methods are not reliable when a covert channel's behavior is slightly modified. In particular, we demonstrate that when confronted with a simple covert channel that we call <tex-math notation="LaTeX">ε</tex-math> - <tex-math notation="LaTeX">κ</tex-math> libur, all detection methods can be circumvented or their performance can be significantly reduced although the covert channel still provides a high bitrate. In comparison to previous timing channels that circumvent these methods, <tex-math notation="LaTeX">ε</tex-math> - <tex-math notation="LaTeX">κ</tex-math> libur is much simpler and eliminates the need of altering previously recorded traffic. Moreover, we propose an enhanced <tex-math notation="LaTeX">ε</tex-math> -similarity that can detect the classical covert timing channel as well as <tex-math notation="LaTeX">ε</tex-math> - <tex-math notation="LaTeX">κ</tex-math> libur.