• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.4
• /
• pp.1866-1883
• /
• 2019

As the youngest branch of information hiding, network covert timing channels conceal the existence of secret messages by manipulating the timing information of the overt traffic. The popular model-based framework for constructing covert timing channels always utilizes cumulative distribution function (CDF) of the inter-packet delays (IPDs) to modulate secret messages, whereas discards high-order statistics of the IPDs completely. The consequence is the vulnerability to high-order statistical tests, e.g., entropy test. In this study, a rich security model of covert timing channels is established based on IPD chains, which can be used to measure the distortion of multi-order timing statistics of a covert timing channel. To achieve rich security, we propose two types of covert timing channels based on nested lattices. The CDF of the IPDs is used to construct dot-lattice and interval-lattice for quantization, which can ensure the cell density of the lattice consistent with the joint distribution of the IPDs. Furthermore, compensative quantization and guard band strategy are employed to eliminate the regularity and enhance the robustness, respectively. Experimental results on real traffic show that the proposed schemes are rich-secure, and robust to channel interference, whereas some state-of-the-art covert timing channels cannot evade detection under the rich security model.

• Journal of Korea Society of Industrial Information Systems
• /
• v.9 no.2
• /
• pp.9-16
• /
• 2004

Recently, lattice conditional independence models(LCIMs) have been introduced for the analysis of non-monotone missing data patterns and of non-nested dependent regression models. This approach has been successfully applied to solve various problems in data pattern analysis, however, it suffers from computational burden to search LCIMs. In order to cope with this drawback, we propose a new scheme for finding LCIMs based on the essential graph. Also, we show that the class of LCIMs coincides with the class of all transitive acyclic directed graph(TADG) models which are Markov equivalent to a specific acyclic directed graph(ADG) models.