The Community for Technology Leaders
The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l (2005)
Sydney, Australia
Nov. 15, 2005 to Nov. 17, 2005
ISSN: 0742-1303
ISBN: 0-7695-2421-4
pp: 802-809
Eugene Tumoian , Taganrog State University
Maxim Anikeev , Taganrog State University
ABSTRACT
<p>A new method of covert channel detection in Initial Sequence Number (ISN) of TCP/IP is proposed in the paper. The detection is based on ISN generation model of original OS. Whenever any statistical deviations of ISN network packet from the ISN model are discovered; it is considered that this ISN packet is generated by malicious software, which tries to create a covert channel. The method was tested using experimental data generated by NUSHU covert channel creation tool, which has been developed by Joanna Rutkowska.</p>
INDEX TERMS
null
CITATION

M. Anikeev and E. Tumoian, "Network Based Detection of Passive Covert Channels in TCP/IP," The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l(LCN), Sydney, Australia, 2005, pp. 802-809.
doi:10.1109/LCN.2005.92
93 ms
(Ver 3.3 (11022016))