[转载]Detection of Covert Channel Encoding in Network Packet Delays

信息来源：邪恶八进制信息安全团队（www.eviloctal.com）

Covert channels are mechanisms for communicating information in ways that are dicult to detect. Data ex ltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet inter-arrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.