Network Packet Length Covert Channel Based on Empirical Distribution Function

Abstract

Network packet length covert channel modulates secret message bits onto the packet lengths to transmit secret messages. In this paper, a novel network packet length covert channel is proposed. The proposed scheme is based on the empirical distribution function of packet length series of legitimate traffic. Different from the existing schemes, the lengths of packets which are generated by the covert sender follow the distribution of normal traffic more closely in our scheme. To validate the security of the proposed scheme, the state-of-the-art packet length covert channel detection algorithm is adopted. The experimental results show that the packet length covert channel provides a significant performance improvement in detection resistance meanings.