Model-Based Covert Timing Channels: Automated Modeling and Evasion Steven Gianvecchio 1, Haining Wang 1, Duminda Wijesekera 2, and Sushil Jajodia 2 1 College of William and Mary 2 George Mason University

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 2 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 3 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 4 Background  Covert Channels  manipulate shared resources to transfer information  hide communication (or extra communication)  exfiltrate sensitive data (e.g., keys, passwords)

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 5 Background  Types of Covert Channels  shared resource is the type  covert storage channels (e.g., packet header fields)  covert timing channels (e.g., packet arrival times)

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 6 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 7  Main Goals  high capacity  strong detection resistance  Capacity –  bits/time unit, not bits/symbol Covert Timing Channels

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 8 Covert Timing Channels  OPtimal Capacity (OPC)  send information as fast as possible  E(X) is small (1,000s of packets/second)  Fixed-average Packet Rate (FPR)  send information as fast as possible with a fixed-average packet rate  E(X) is fixed (a few packets/second)

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 9 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 10 Model-Based Framework  The Framework  filters and analyzes legitimate traffic  encodes and transmits covert traffic

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 11 Components  Filter  filters input for the specified type of traffic (e.g., outgoing HTTP)  outputs legitimate IPDs

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 12 Components  Analyzer  fits the legitimate IPDs to several models using MLE (blocks of 100 IPDs)  selects the model with the lowest RMSE

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 13 Components  Encoder  uses the IDF of the model  generates covert IPDs that mimic the legitimate traffic

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 14 Encoding / Decoding  1. Continuize  2. Encode  3. Decode  4. Discretize

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 15 Components  Transmitter  sends out packets with covert IPDs  Receiver and Decoder  receive packets and decode message

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 16 Model-Based Framework  Implementation Details  components run in user space  filter, encoder, transmitter written in C; plus inline assembly for RDTSC  analyzer written in MATLAB

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 17 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 18 Experimental Evaluation  Test Scenarios  LAN, WAN East-to-East, WAN East-to-West LANWAN-EEWAN-EW distance0.3 mi525 mi2660 mi RTT1.7ms59.6ms87.2ms IPDV2.5e e-032.1e-04 hops31813 IPDV – inter-packet delay variation

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 19 Test Setup  MB-HTTP  Weibull – avg. λ = , avg. k =  E(X) is (~3 packets/second)  OPC  E(X) is 7.31e-3 to 7.87e-5 (1,515 to 12,777 packets/second)  FPR  Exponential – λ =  E(X) is (~3 packets/second)

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 20 Theoretical Capacity channel LANWAN-EEWAN-EW CPPCPSCPPCPSCPPCPS MB-HTTP OPC 0.506, FPR CPP – capacity/packet, CPS = capacity/second  LAN, WAN East-East, WAN East-West  OPC has highest capacity

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 21 Theoretical Capacity channel LANWAN-EEWAN-EW CPPCPSCPPCPSCPPCPS MB-HTTP OPC 0.506, FPR CPP – capacity/packet, CPS = capacity/second  LAN, WAN East-East, WAN East-West  MB-HTTP and FPR are close

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 22 Empirical Capacity  WAN East-East  MB-HTTP versus FPR  capacity and bit error degrade quickly

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 23 Empirical Capacity  WAN East-West  MB-HTTP versus FPR  capacity and bit error degrade slowly

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 24 Empirical Capacity channel LANWAN-EEWAN-EW CPPCPSCPPCPSCPPCPS MB-HTTP OPC , ,512 FPR CPP – capacity/packet, CPS = capacity/second  LAN, WAN East-East, WAN East-West  OPC again has the highest capacity

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 25 Empirical Capacity channel LANWAN-EEWAN-EW CPPCPSCPPCPSCPPCPS MB-HTTP OPC , ,512 FPR CPP – capacity/packet, CPS = capacity/second  LAN, WAN East-East, WAN East-West  MB-HTTP and FPR are still close

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 26 Tests of Shape:  Kolmogorov-Smirnov test – where s 1 and s 2 are distribution functions Tests of Regularity:  The regularity test (Cabuk 2004) – 26 Detection Resistance

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 27 KSTEST LEGIT-HTTPMB-HTTP FPROPC sample size meanstddevm.s.d.m.s.dm.s.d 100x2, x10, x50, x250,  KSTEST scores  high mean and low s.d. for FPR and OPC

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 28 KSTEST LEGIT-HTTPMB-HTTP FPROPC sample size meanstddevm.s.d.m.s.dm.s.d 100x2, x10, x50, x250,  KSTEST scores  similar mean and s.d. for LEGIT and MB-HTTP

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 29 KSTEST  KSTEST distribution  similar distributions for LEGIT-HTTP and MB- HTTP scores

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 30 KSTEST  KSTEST distribution  LEGIT-HTTP and MB-HTTP overlap even with 250,000 packets

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 31 KSTEST LEGIT-HTTPMB-HTTP FPROPC sample sizeFPTP 100x2, x10, x50, x250,  KSTEST detection rates  FPR and OPC are detected easily

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 32 KSTEST LEGIT-HTTPMB-HTTP FPROPC sample sizeFPTP 100x2, x10, x50, x250,  KSTEST detection rates  FP equals TP for LEGIT and MB-HTTP

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 33 regularity LEGIT-HTTPMB-HTTP FPROPC sample sizemean 100x2,000 w= x2,000 w=  regularity scores  similar mean for LEGIT and MB-HTTP

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 34 regularity LEGIT-HTTPMB-HTTP FPROPC sample sizeFPTP 100x2,000 w= x2,000 w=  regularity detection rates  MB-HTTP is not detected at all

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 35 regularity LEGIT-HTTPMB-HTTP FPROPC sample sizeFPTP 100x2,000 w= x2,000 w=  regularity detection rates  again FPR and OPC are detected easily

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 36 Outline  Background  Covert Timing Channels  Model-Based Framework  Experimental Evaluation  Capacity  Detection Resistance  Conclusion

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 37 Conclusion  Model-Based Covert Timing Channels  can be built automatically  effective even in coast-to-coast scenario  capacity is very close to FPR  much stronger detection resistance than FPR and OPC

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 38 Conclusion (cont.)  Future Work  investigate detection methods for model- based covert timing channels  explore other more advanced covert timing channel designs (e.g., non-parametric models)

RAID 2008 Model-Based Covert Timing Channels: Automated Modeling and Evasion 39 Questions? Thank You!