Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6
Increased usage of the Internet has risen the demand for more IP addresses across the globe resulting in replacement of IPv4 by IPv6 protocol. Hence, security of IPv6 has become a vital area of research. One of the serious threats to Internet security is the presence of Network Covert Channels (NCCs...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9921302/ |
| _version_ | 1817978180795891712 |
|---|---|
| author | Arti Dua Vinita Jindal Punam Bedi |
| author_facet | Arti Dua Vinita Jindal Punam Bedi |
| author_sort | Arti Dua |
| collection | DOAJ |
| description | Increased usage of the Internet has risen the demand for more IP addresses across the globe resulting in replacement of IPv4 by IPv6 protocol. Hence, security of IPv6 has become a vital area of research. One of the serious threats to Internet security is the presence of Network Covert Channels (NCCs) that provide substantial aid for performing covered communications like exchanging secret data and/or exfiltrating secret information from the organizations. To detect such malicious activities, there is an urgent requirement to develop and deploy efficient detection mechanisms in real-time networks. Further, to decode the hidden communications, there is an additional need to identify the location of covert data. Thus, this paper proposes a system for detecting and locating storage-based NCC(s) in IPv6 using Deep Neural Network (DNN) and One-vs-Rest (OvR) technique with Support Vector Machine (SVM). The proposed system is a two-layered system. Layer 1 detects an IPv6 packet as a normal/covert packet. Layer 2 locates the storage area of secret data in the covert packets detected at Layer 1. For experimentation, a dataset of normal and covert IPv6 packets was created using CAIDA’s dataset and pcapStego tool. Experiments were conducted to select the appropriate classifiers at both layers of the proposed system. With DNN and OvR SVM selected as the classifiers at Layer 1 and Layer 2 respectively, the proposed system locates covert data in IPv6 packets with an Accuracy of 99.7% and an average prediction time of 0.0719 seconds per covert sample, making it suitable for real-time deployment. |
| first_indexed | 2024-04-13T22:26:47Z |
| format | Article |
| id | doaj.art-7287446607ff45f282b6195870afb2a7 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-13T22:26:47Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-7287446607ff45f282b6195870afb2a72022-12-22T02:27:03ZengIEEEIEEE Access2169-35362022-01-011011066111067510.1109/ACCESS.2022.32151329921302Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6Arti Dua0https://orcid.org/0000-0002-7663-5999Vinita Jindal1https://orcid.org/0000-0002-0481-4840Punam Bedi2Bhaskaracharya College of Applied Sciences, University of Delhi, New Delhi, Delhi, IndiaKeshav Mahavidyalaya, University of Delhi, New Delhi, Delhi, IndiaDepartment of Computer Science, University of Delhi, New Delhi, Delhi, IndiaIncreased usage of the Internet has risen the demand for more IP addresses across the globe resulting in replacement of IPv4 by IPv6 protocol. Hence, security of IPv6 has become a vital area of research. One of the serious threats to Internet security is the presence of Network Covert Channels (NCCs) that provide substantial aid for performing covered communications like exchanging secret data and/or exfiltrating secret information from the organizations. To detect such malicious activities, there is an urgent requirement to develop and deploy efficient detection mechanisms in real-time networks. Further, to decode the hidden communications, there is an additional need to identify the location of covert data. Thus, this paper proposes a system for detecting and locating storage-based NCC(s) in IPv6 using Deep Neural Network (DNN) and One-vs-Rest (OvR) technique with Support Vector Machine (SVM). The proposed system is a two-layered system. Layer 1 detects an IPv6 packet as a normal/covert packet. Layer 2 locates the storage area of secret data in the covert packets detected at Layer 1. For experimentation, a dataset of normal and covert IPv6 packets was created using CAIDA’s dataset and pcapStego tool. Experiments were conducted to select the appropriate classifiers at both layers of the proposed system. With DNN and OvR SVM selected as the classifiers at Layer 1 and Layer 2 respectively, the proposed system locates covert data in IPv6 packets with an Accuracy of 99.7% and an average prediction time of 0.0719 seconds per covert sample, making it suitable for real-time deployment.https://ieeexplore.ieee.org/document/9921302/Cybersecuritydeep neural networkinternet protocol version 6machine learningnetwork covert channel detectionone-vs-rest |
| spellingShingle | Arti Dua Vinita Jindal Punam Bedi Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 IEEE Access Cybersecurity deep neural network internet protocol version 6 machine learning network covert channel detection one-vs-rest |
| title | Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 |
| title_full | Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 |
| title_fullStr | Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 |
| title_full_unstemmed | Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 |
| title_short | Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6 |
| title_sort | detecting and locating storage based covert channels in internet protocol version 6 |
| topic | Cybersecurity deep neural network internet protocol version 6 machine learning network covert channel detection one-vs-rest |
| url | https://ieeexplore.ieee.org/document/9921302/ |
| work_keys_str_mv | AT artidua detectingandlocatingstoragebasedcovertchannelsininternetprotocolversion6 AT vinitajindal detectingandlocatingstoragebasedcovertchannelsininternetprotocolversion6 AT punambedi detectingandlocatingstoragebasedcovertchannelsininternetprotocolversion6 |