Login | Register

An approach towards anomaly based detection and profiling covert TCP/IP channels


An approach towards anomaly based detection and profiling covert TCP/IP channels

Gilbert, Patrick A (2009) An approach towards anomaly based detection and profiling covert TCP/IP channels. Masters thesis, Concordia University.

Text (application/pdf)
MR63156.pdf - Accepted Version


Firewalls and detection systems have been used for preventing and detecting attacks by a wide variety of mechanisms. A problem has arisen where users and applications can circumvent security policies because of the particularities in the TCP/IP protocol, the ability to obfuscate the data payload, tunnel protocols, and covertly simulate a permitted communication. It has been shown that unusual traffic patterns may lead to discovery of covert channels that employ packet headers. In addition, covert channels can be detected by observing an anomaly in unused packet header fields. Presently, we are not aware of any schemes that address detecting anomalous traffic patterns that can potentially be created by a covert channel. In this work, we will explore the approach of combining anomaly based detection and covert channel profiling to be used for detecting a very precise subset of covert storage channels in network protocols. We shall also discuss why this method is more practical and industry-ready compared to the present research on how to profile and mitigate these types of attacks. Finally, we shall describe a specialized tool to passively monitor networks for these types of attacks and show how it can be used to build an efficient hybrid covert channel and anomaly based detection system.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Thesis (Masters)
Authors:Gilbert, Patrick A
Pagination:ix, 91 leaves : ill. ; 29 cm.
Institution:Concordia University
Degree Name:M.A. Sc
Program:Institute for Information Systems Engineering
Thesis Supervisor(s):Bhattacharya, P
ID Code:976643
Deposited By: Concordia University Library
Deposited On:22 Jan 2013 16:30
Last Modified:18 Jan 2018 17:42
Related URLs:
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top