关键词: 网络隐蔽通道, 混合, 伪随机序列, 自适应, SVM检测算法

Abstract:

Existing network covert channel research mainly focuses on single modes such as storage, timing and sequential. The simple use of the same method has a greater impact on network traffic, resulting in poor concealment. It is rare to use multiple modes to build a hybrid covert channel. This paper proposes a new construction method of hybrid covert channels, and establishes a covert channel construction framework that can adaptively change according to the current network traffic characteristics. It generates a pseudo-random sequence with a certain distribution through the concealment of real-time network traffic under different modes of covert channels, and writes covert information in different channels according to the pseudo-random sequence. The covert information is randomly present in a variety of modes during the transmission of information, and the change of the original traffic is reduced while the covert information is transmitted, and the usage mode is dynamically adjusted in real time according to the network traffic. Experimental results in a real network environment have proved that this kind of covert channel has strong covertness and adaptability, and its practical value is obvious.

Key words: network covert channel, hybrid, pseudo-random sequence, self-adaptive, SVM detection algorithm