The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l (2005)
Nov. 15, 2005 to Nov. 17, 2005
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/LCN.2005.92
Eugene Tumoian , Taganrog State University
Maxim Anikeev , Taganrog State University
<p>A new method of covert channel detection in Initial Sequence Number (ISN) of TCP/IP is proposed in the paper. The detection is based on ISN generation model of original OS. Whenever any statistical deviations of ISN network packet from the ISN model are discovered; it is considered that this ISN packet is generated by malicious software, which tries to create a covert channel. The method was tested using experimental data generated by NUSHU covert channel creation tool, which has been developed by Joanna Rutkowska.</p>
M. Anikeev and E. Tumoian, "Network Based Detection of Passive Covert Channels in TCP/IP," The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l(LCN), Sydney, Australia, 2005, pp. 802-809.