Covert Timing Channel Analysis Either as Cyber Attacks or Confidential Applications

Area of Science:

• Computer Science
• Network Security
• Information Theory

Background:

• Covert timing channels leverage inter-arrival packet times for data transmission in IoT networks.
• These channels modify legitimate traffic timing, primarily through packet delays, posing security risks.
• Accurately distinguishing covert traffic from normal network behavior is crucial for threat assessment.

Purpose of the Study:

• To analyze the inter-arrival time behavior of covert timing channels in diverse network setups.
• To determine the critical packet delay threshold for reliable detection of covert channels.
• To assess the security implications of covert timing channels in IoT environments.

Main Methods:

• Statistical metrics were employed to study inter-arrival time patterns.
• Experiments were conducted across two distinct network configurations.
• The packet delaying threshold was investigated in relation to legitimate traffic.

Main Results:

• The study identified that a packet delay threshold approximately double the mean legitimate inter-arrival time is effective.
• Covert timing channels are detectable as significant anomalies when this threshold is met or exceeded.
• Network configuration influences the characteristics of covert channel timing.

Conclusions:

• The determined threshold provides a quantifiable metric for detecting covert timing channels in IoT.
• Understanding this threshold enhances the ability to identify and mitigate potential security threats.
• This research contributes to securing IoT communications against covert data exfiltration techniques.