Inter-packet delays (IPD) of legitimate network traffic can be exploited for information hiding purposes and distribution of secret and sensitive data. This process is known as Covert Timing Channel (CTC), which is usually used for malicious purposes. In this paper we propose a novel approach, CTC Real-Time Detection (CTCRTD) to detect such activities based on IPD distributions of network traffic. We present and leverage three different non-parametric statistical tests that can be used to generate distinct statistical test scores for overt and covert traffic IPDs. Our new detection approach is designed around two major benefits: First, the new detection approach can detect various CTC algorithms that have similar impact on network traffic IPD distributions. Second, our detection approach reliably detects covert communication over real-time network traffic with minimal lag between the start of covert activity and the point of detection. We have evaluated and verified the reliability and effectiveness of our detection approach utilizing a large number of overt and covert traffic streams and various scenarios of the proposed detection technique. The obtained results show that the new detection approach can precisely differentiate between overt and covert network traffic and detect covert communication activities over 90 percent of time on average.

Covert channels exploit side channels within existing network resources to transmit secret messages. They are integrated into the elements of network resources that were not even designed for the purpose of communication. This means that traditional security features like firewalls cannot detect them. Their ability to evade detection makes covert channels a grave security concern. Hence, it is imperative to detect and disrupt them. However, a generic mechanism that can be used to detect a large variety of covert channels is missing. In this paper, we propose a support vector machine (SVM)-based framework for reliable detection of covert communications. The machine learning framework utilizes the fingerprints derived from the traffic under investigation to classify the traffic as covert or overt. We trained our classifier using the fingerprints from four popular and diverse covert timing channel algorithms and tested each of them independently. We have shown that the machine learning framework has great potential to blindly detect covert channels, even when the covert message size is reduced.

Extensive availability and development of Internet applications and services open up the opportunity for abusing network and Internet resources to distribute malicious data and leak sensitive information. One of the prevalent information-hiding approaches suitable for such activities is known as Covert Timing Channel (CTC), which utilizes the modulation of Inter-Packet Delays (IPDs) to embed secret data and transfers that to designated receivers. In this paper, we propose two different non-parametric statistical tests that can be employed to detect this type of covert communication activities over a network. The new detection metrics are evaluated and verified against four different and highly recognized CTC algorithms. The experimental results show that the proposed detection metrics can reliably and effectively distinguish between the covert and overt traffic flows, thus significantly supporting our research toward an accurate blind and comprehensive CTC detection. This is a capability vital to cyber security in today's information society.

Personnel safety is an integral element of any railroad operation. Rail tracks need to be regularly maintained, which often requires rail workers to be physically present on possibly live tracks along with their equipment. This results in hazardous work conditions for the workers. To ensure worker safety a reliable system for detecting oncoming trains and alerting the workers, while giving them sufficient time to disengage from the worksite, is essential. In this paper, we present a multiple sensor based system that integrates the sensor elements with a signal processing unit for this purpose. The processing unit consists of a signal conditioning unit, a data processing unit and a machine learning framework. The conditioning unit prepares the acquired signals for later operations. The data processing unit extracts fingerprints from the reported signals that are later used by the machine learning framework as training and testing samples. The machine framework is a binary tree that classifies the event under investigation as presence or absence of a train on the track under observation. We show that the system is very accurate and can alert the workers under five seconds after the arrival of the train at the test site.

In this paper, we introduce an automated framework that can model covert communication algorithms. Our proposed framework, Automated Covert Channel Modeling ACCM, can provide a reliable and valid implementation method for fully functional covert communication techniques that can be used to study various concepts, characteristics and features of covert communication. ACCM exploits the shared features of covert channel algorithms to define common blocks and automatically converts tasks and events of the common blocks to executable codes. In order to verify the accuracy of our proposed ACCM framework, we implement two different covert channel algorithms that are referenced repeatedly in literature. We demonstrate that the characteristics obtained from implementing covert communication using the ACCM framework match the theoretical concepts of network communication and the expected results. Copyright © 2014 John Wiley & Sons, Ltd.

Advances in wireless communication protocols and networking toward support of the next generation of mobile and radio broadband technologies have contributed to a strong competition among various telecommunication standards in particular Long Term Evolution LTE and Mobile Worldwide Interoperability for Microwave Access WiMAX. In this paper, we provide an in-depth comparison analysis of LTE and Mobile WiMAX at the physical PHY layer by studying the most similar PHY configuration scenarios for these two technologies. Our study includes a throughput analysis of downlink DL and uplink UL transmissions in time division duplex with the least overhead possible and different antenna schemes as well as modulation and code rates. This study also performs an overhead analysis in both protocols to provide a more in-depth understanding of the PHY layer capacity in various PHY layer configurations. Our simulation results generally show higher performance for LTE in both DL and UL transmission with 7Mbps in DL and 5Mbps in UL, when using one antenna port. However, by increasing the number of antennas for multiple-input/multiple-output configurations, the results illustrate a reduction in the performance of LTE compared to Mobile WiMAX. This arises from the increase in reference signal overhead in LTE from 4.7% in single-input/single-output SISO to 14.28% in 4×4 multiple-input/multiple-output MIMO. Copyright © 2013 John Wiley & Sons, Ltd.

In this paper, we introduce a covert timing channel (CTC) algorithm and compare it to one of the most prevailing CTC algorithms, originally proposed by Cabuk et al. CTC is a form of covert channels - methods that exploit network activities to transmit secret data over packet-based networks - by modifying packet timing. This algorithm is a seminal work, one of the most widely cited CTCs, and the foundation for many CTC research activities. In order to overcome some of the disadvantages of this algorithm we introduce a covert timing channel technique that leverages timeout thresholds. The proposed algorithm is compared to the original algorithm in terms of channel capacity, impact on overt traffic, bit error rates, and latency. Based on our simulation results the proposed algorithm outperforms the work from Cabuk et al., especially in terms of its higher covert data transmission rate with lower latency and fewer bit errors. In our work we also address the desynchronization problem found in Cabuk et al.'s algorithm in our simulation results and show that even in the case of the synchronization-corrected Cabuk et al. algorithm our proposed method provides better results in terms of capacity and latency.

In this paper we introduce a new approach for modeling covert channel algorithms utilizing automated code generation and evaluation in real network environments. Our proposed framework is called Automated Covert Channel Modeling over Networks (ACCM-Net), which allows the user to convert any general description of a covert channel algorithm into executable code using an automated process. The resulting code can be executed on virtual or physical hardware utilizing actual network links to evaluate the behavior of the covert channel algorithm and observe diverse characteristics and features of its covert communication. We have tested our proposed ACCM-Net framework with several well-known covert channel algorithms with positive results. Here, we present the implementation, and analysis of the widely adopted On/Off covert channel algorithm utilizing our proposed ACCM-Net. Based on our results, the implemented On/Off algorithm is functioning precisely and accurately.

The growth of the Internet and online social media, especially in recent years, also gave rise to a proliferation of online multimedia content creation and distribution. The use of modern steganography methods - the art of hiding information within multimedia - presents an unprecedented opportunity for malicious uses of these materials. Therefore, developing an effective technique to avoid the distribution of secret data is a significant problem that is addressed in this paper for digital images. We introduce a novel algorithm to remove the steganography information embedded in an image without changing the quality of the image and with no prior knowledge of the utilized steganography technique. Our new algorithm called Adaptive Threshold Displacement (ATD) is applied to images in the spatial domain. ATD divides the whole image into different segments and within a given segment, some pixels are displaced according to their contents as well as their neighboring pixel values. For evaluating the effectiveness of our proposed algorithm, we apply ATD to different images that contain hidden information, embedded using two different widely used steganography techniques. The presented results show that virtually all of the hidden information is destroyed by our proposed ATD algorithm, with a retrieval BER of over 40% in average. However, the quality of the images does not change and the PSNR of the resulting images is above 32 dB.

In this paper, we present and investigate a method to multimedia steganography removal methodand remove multimedia steganography in digital audio data. Among the existing steganography methods that can be used to hide secret data in digital audio carriers, the Spread Spectrum methods are among the most effective and robust for embedding steganography data. Though there are currently a few research efforts on removing or destroying steganography in multimedia, there have been very few efforts on removing steganography from audio. In this paper, we have introduced a simple but very effective anti-steganography approach for removing hidden information from digital audio data embedded using Spread Spectrum methods. The main concept in our approach is to leverage limited pseudo-random shuffling of the samples in the audio stream so that the synchronization information necessary for decoding Spread Spectrum steganography information cannot be attained. Our simulation results in this paper have demonstrated great performance in removing audio steganography by achieving a 50% bit error rate after applying our anti-steganography approach to the digital audio data while maintaining the audio quality.

In this paper, we have investigated Covert Channels in 3GPP LTE-A (Long Term Evolution-Advanced) for identifying headers and extension fields where covert data can be hidden in covert communications. We also discuss the covert channel capacity for LTE-A where the specific fields in the headers of the MAC (Medium Access Control), RLC (Radio Link Control) and PDCP (Packet Data Convergence Protocol) layers are analyzed. We review different scenarios of channel coding rate, modulation schemes and channel bandwidths and present our results.

In this paper, we introduce a novel algorithm to destroy the steganographic information embedded in an image without changing the quality of the image and with no prior knowledge of the used steganography scheme. We propose the new Neighbor Class Displacement (NCD) algorithm, which arranges the pixels of an image into a given number of classes. The elements of two specific classes are substituted with each other based on different conditions related to the content of the class elements. For evaluating the effectiveness of our attack, we apply NCD to different steganographically modified images to remove the embedded hidden information. Our results show that over 40% of the steganography bits are toggled in natural images by our proposed attack algorithm, which means the hidden information is removed effectively. Additionally, the visual quality of the images does not change and the PSNR of the original and attacked images is above 32 dB. We compare our attack to other signal processing and geometrical attacks and show that our NCD scheme outperforms other steganography attack algorithms while maintaining the quality of the host image.

LTE (3GPP Release8) and Mobile WiMAX (IEEE 802.16e) are discussed extensively as choices for the next generation of mobile broadband technologies. In this paper, LTE and Mobile WiMAX are analyzed comprehensively from a physical layer performance point of view for different antenna diversity modes in downlink and uplink transmissions. The objective of this study is to fill the current gaps in published literature for comparative in-depth analysis of the performance of LTE and Mobile WiMAX. Our study considers maximum channel bandwidth and the least control information overhead for both protocols. Performance comparison results for different scenarios of TDD (Time Division Duplex) operation in similar configurations suggest that LTE in general outperforms Mobile WiMAX. The throughput comparison of FDD (Frequency Division Duplex) and TDD operations is also presented in this paper to provide a complete discussion of physical layer maximum throughput in LTE.