Engineering Statistical Behaviors for Attacking and Defending Covert Channels

摘要: This paper develops techniques for attacking and defending behavioral anomaly detection methods commonly used in network traffic analysis covert channels. The main new result is our demonstration of how to use a behavior's or process' k-order statistics build stochastic process that has the same stationary but possesses different, deliberately designed, (k+1) -order if desired. Such model realizes “complexification” behavior which defender can monitor whether an attacker shaping behavior. We also describe source coding technique respects k statistics, including entropy first order statistic example, while encoding information covertly, we show achieve optimizing rates. Although results examples are stated terms channels, more generally applicable analysis. One fundamental consequence these certain types come down arms race sense advantage goes party computing resources applied problem.