<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>2397</id>
    <completedYear>2024</completedYear>
    <publishedYear>2024</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst>1</pageFirst>
    <pageLast>10</pageLast>
    <pageNumber>10</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>ACM</publisherName>
    <publisherPlace>New York, NY, USA</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>1</belongsToBibliography>
    <completedDate>--</completedDate>
    <publishedDate>2024-07-30</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">A Case Study on the Detection of Hash-Chain-based Covert Channels Using Heuristics and Machine Learning</title>
    <abstract language="eng">Reversible network covert channels restore the original carrier object before forwarding it to the overt receiver, drawing them a security threat hard to detect. Some of these covert channels utilize computational intensive operations, such as the calculation of cryptographic hashes. This paper proposes utilizing shape analysis of packet runtime distributions to detect such computational intensive covert channels. To this end, we simulated the latency of covert channel-modified traffic by adding mock hash-reconstruction delays to runtimes of legitimate ping traffic. After qualitatively observ-&#13;
ing the changes in the empirical probability distribution between modified and natural traffic, we investigated machine learning algorithms for their ability to detect such covert channels. Our results show that a decision tree-based AdaBoost classifier and a CNN using the investigated statistical measures as input vector are able to classify sets of 50 ping measurements with high accuracy. Our approach is superior over previous work on the detection of computational intensive covert channels as it requires smaller sampling window sizes, achieves significantly higher detection rates, and thus draws detection more reliable with fewer preparation.</abstract>
    <identifier type="doi">10.1145/3664476.3670877</identifier>
    <enrichment key="opus_doi_flag">true</enrichment>
    <enrichment key="opus_import_data">{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,10,17]],"date-time":"2024-10-17T04:36:06Z","timestamp":1729139766959,"version":"3.27.0"},"publisher-location":"New York, NY, USA","reference-count":35,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7,30]]},"DOI":"10.1145\/3664476.3670877","type":"proceedings-article","created":{"date-parts":[[2024,7,25]],"date-time":"2024-07-25T16:35:50Z","timestamp":1721925350000},"page":"1-10","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["A Case Study on the Detection of Hash-Chain-based Covert Channels Using Heuristics and Machine Learning"],"prefix":"10.1145","author":[{"ORCID":"http:\/\/orcid.org\/0009-0001-3783-4522","authenticated-orcid":false,"given":"Jeff","family":"Schymiczek","sequence":"first","affiliation":[{"name":"University of Helsinki, Finland"}]},{"ORCID":"http:\/\/orcid.org\/0000-0001-5912-0857","authenticated-orcid":false,"given":"Tobias","family":"Schmidbauer","sequence":"additional","affiliation":[{"name":"Nuremberg Institute of Technology, Germany"}]},{"ORCID":"http:\/\/orcid.org\/0000-0002-1913-5912","authenticated-orcid":false,"given":"Steffen","family":"Wendzel","sequence":"additional","affiliation":[{"name":"Center for Technology and Transfer, Worms University of Applied Sciences, Germany and FernUniversit\u00e4t in Hagen, Germany"}]}],"member":"320","published-online":{"date-parts":[[2024,7,30]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-99619-2_51"},{"key":"e_1_3_2_1_2_1","unstructured":"Vincent Berk A. Giani and C. Cybenko. 2005. Detection of Covert Channel Encoding in Network Packet Delays. (2005)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1513601.1513604"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.3390\/app11041641"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2022.3178205"},{"key":"e_1_3_2_1_6_1","unstructured":"Fran\u0107ois Chollet. 2015. Keras. https:\/\/keras.io"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3164392"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3517419"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36415-3_2"},{"volume-title":"Proceedings of the Italian Conference on Cybersecurity (ITASEC 2022), Rome, Italy, June 20-23, 2022(CEUR Workshop Proceedings, Vol.\u00a03260)","year":"2022","author":"Guarascio Massimo","key":"e_1_3_2_1_11_1","unstructured":"Massimo Guarascio, Marco Zuppelli, Nunziato Cassavia, Giuseppe Manco, and Luca Caviglione. 2022. Detection of Network Covert Channels in IoT Ecosystems Using Machine Learning. In Proceedings of the Italian Conference on Cybersecurity (ITASEC 2022), Rome, Italy, June 20-23, 2022(CEUR Workshop Proceedings, Vol.\u00a03260), Camil Demetrescu and Alessandro Mei (Eds.). CEUR-WS.org, 102\u2013113. https:\/\/ceur-ws.org\/Vol-3260\/paper7.pdf"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC6234"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-020-2649-2"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2023.3303674"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603781.3603906"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.3390\/app11020731"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/358790.358797"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/362375.362389"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3339252.3341493"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"crossref","unstructured":"Wojciech Mazurczyk; Steffen Wendzel Sebastian Zander Amir Houmansadr and Krzysztof Szczypiorski. 2016. Information Hiding in Communication Networks: Fundamentals Mechanisms Applications and Countermeasures | IEEE eBooks | IEEE Xplore. https:\/\/ieeexplore.ieee.org\/book\/7434879","DOI":"10.1002\/9781119081715"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.2478\/s13537-014-0205-6"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2961609"},{"volume-title":"Scikit-learn: Machine Learning in Python. J. Mach. Learn. Res. 12 (jan","year":"2012","author":"Pedregosa Fabian","key":"e_1_3_2_1_24_1","unstructured":"Fabian Pedregosa, Ga\u00ebl Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Andreas M\u00fcller, Joel Nothman, Gilles Louppe, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, Jake Vanderplas, Alexandre Passos, David Cournapeau, Matthieu Brucher, Matthieu Perrot, and \u00c9douard Duchesnay. 2012. Scikit-learn: Machine Learning in Python. J. Mach. Learn. Res. 12 (jan 2012), 2825\u20132830. arxiv:1201.0490http:\/\/arxiv.org\/abs\/1201.0490"},{"key":"e_1_3_2_1_25_1","unstructured":"RIPE. 2022. Index of \/datasets\/atlas-daily-dumps. https:\/\/data-store.ripe.net\/datasets\/atlas-daily-dumps\/"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","unstructured":"Ronald\u00a0L. Rivest. 1992. The MD5 Message-Digest Algorithm. Request for Comments 1321. https:\/\/doi.org\/10.17487\/RFC1321","DOI":"10.17487\/RFC1321"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3538969.3544455"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470085"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.22667\/JOWUA.2022.03.31.137"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3605021"},{"volume-title":"Proceedings of CRYPTO \u201983","year":"1983","author":"Simmons J.","key":"e_1_3_2_1_31_1","unstructured":"Gustavus\u00a0J. Simmons. 1983. The Prisoners\u2019 Problem and the Subliminal Channel. In Advances in Cryptology, Proceedings of CRYPTO \u201983, Santa Barbara, California, USA, August 21-24, 1983. Plenum Press, New York, 51\u201367."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3168018"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1038\/S41592-019-0686-2"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevResearch.1.033034"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2007.4317620"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3241451"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.011.2200744"}],"event":{"name":"ARES 2024: The 19th International Conference on Availability, Reliability and Security","acronym":"ARES 2024","location":"Vienna Austria"},"container-title":["Proceedings of the 19th International Conference on Availability, Reliability and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3664476.3670877","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,17]],"date-time":"2024-10-17T01:36:57Z","timestamp":1729129017000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664476.3670877"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,30]]},"references-count":35,"alternative-id":["10.1145\/3664476.3670877","10.1145\/3664476"],"URL":"http:\/\/dx.doi.org\/10.1145\/3664476.3670877","relation":{},"subject":[],"published":{"date-parts":[[2024,7,30]]},"assertion":[{"value":"2024-07-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}</enrichment>
    <enrichment key="local_crossrefDocumentType">proceedings-article</enrichment>
    <enrichment key="local_import_origin">crossref</enrichment>
    <enrichment key="local_doiImportPopulated">PersonAuthorFirstName_1,PersonAuthorLastName_1,PersonAuthorIdentifierOrcid_1,PersonAuthorFirstName_2,PersonAuthorLastName_2,PersonAuthorIdentifierOrcid_2,PersonAuthorFirstName_3,PersonAuthorLastName_3,PersonAuthorIdentifierOrcid_3,Enrichmentconference_title,Enrichmentconference_place,PublisherName,PublisherPlace,TitleMain_1,TitleParent_1,PageNumber,PageFirst,PageLast,CompletedYear</enrichment>
    <enrichment key="conference_place">Vienna Austria</enrichment>
    <enrichment key="Reviewstatus">Begutachtet/Reviewed</enrichment>
    <enrichment key="opus.source">doi-import</enrichment>
    <enrichment key="ConferenceStatement">ARES '24: Proceedings of the 19th International Conference on Availability, Reliability and Security</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">false</enrichment>
    <author>Jeff Schymiczek</author>
    <author>Tobias Schmidbauer</author>
    <author>Steffen Wendzel</author>
    <collection role="institutes" number="">Fakultät Informatik</collection>
    <collection role="Forschungsschwerpunkt" number="5">Digitalisierung &amp; Künstliche Intelligenz</collection>
  </doc>
</export-example>
