Implementing a covert timing channel based on mimic function

Abstract

Covert timing channel is a mechanism that can be exploited by an attacker to conceal secrets in timing intervals of transmitted packets. With the development of detection techniques against such channel, it has become increasingly difficult to exploit a practical covert timing channel that is both detection-resistant and of high capacity. In this paper, we introduce a new type of covert timing channel. Our novel encoding technique uses mimic functions as the basis to accomplish the mimicry of legitimate traffic behaviors. We also design and implement a mimicry framework for automatically creating this new type of covert timing channel. In the end, we utilize the state-of-the-art detection tests to validate the effectiveness of our mimicry approach. The experimental results show that the created covert timing channel can successfully evade the detection tests while achieving a considerable channel capacity. © 2014 Springer International Publishing.