Covert Channel Establishment through the Dynamic Adaptation of the Sequential Probability Ratio Test to Sensor Data in IoT

Abstract

Owing to their hidden natures, covert channels can be utilized such that trojan applications can communicate stealthily with each other or exchange stolen private information without being revealed. To prevent damage incurred by covert channels, researchers have preemptively scrutinized diverse covert channels that can be devised by an attacker. Although covert channels based on sensor data may interest an attacker because sensing operation is a key task in Internet of Things (IoT), we do not find any covert channel studies that adapted the Sequential Probability Ratio Test (SPRT) to sensor data except our prior study [27], where the SPRT is applied to sensor data in Android systems before an attacker's conception; however, our previous study showed limitations owing to the static nature of the SPRT parameter settings and the method of mapping sensor data to sample types for covert channel creation. To demonstrate that these limitations can be pacified, we propose a covert channel that dynamically applies the SPRT to sensor data in IoT. In our proposed covert channel, stealthy information bit 1 (resp. 0) is encoded to and decoded from a sequence of sensor data when the SPRT with dynamic parameter settings accepts an alternate (resp. null) hypothesis. We implement our proposed covert channel in Raspberry Pi 3 Model B devices and evaluate it in terms of various metrics. Evaluation results indicate that every encoded stealthy information byte is successfully decoded in our covert channel. Furthermore, 3.513 samples and 28.105 SPRT executions at the most are required for encoding/decoding a stealthy information byte in our devised covert channel on an average, thus resulting in fast encoding/decoding in our covert channel. Finally, our developed covert channel yields a throughput ranging from 4097.5 to 9061.67 bits/sec.