论文标题
协议代理：基于FTE的秘密通道
Protocol Proxy: An FTE-based Covert Channel
论文作者
论文摘要
在敌对的网络环境中，用户必须通信而不会被检测到。这涉及与现有流量混合。在某些情况下，需要更高的保密性。我们提出了概念验证格式转换加密（FTE）的秘密通道，用于通过受保护的静态协议来隧穿TCP流量。受保护的静态协议是基于UDP的协议，具有可变字段，而没有附带损坏，例如电网故障。我们（1）将TCP流量转换为UDP流量，（2）引入基于观察的FTE，以及（3）使用确定性隐藏的Markov模型（HMM）的包装插入时间安排。所得协议代理的检测概率很低，是当前秘密通道的替代方案。我们通过UDP协议隧道隧道会话并保证交付。基于观察的FTE确保无法通过传统的基于规则的分析或DPI检测到流量。确定性的HMM确保协议代理准确地模拟了包装室时机，以避免通过侧通道分析检测。最后，选择受保护的静态协议挫败了状态方案分析，并以假阳性造成附带损害。
In a hostile network environment, users must communicate without being detected. This involves blending in with the existing traffic. In some cases, a higher degree of secrecy is required. We present a proof-of-concept format transforming encryption (FTE)-based covert channel for tunneling TCP traffic through protected static protocols. Protected static protocols are UDP-based protocols with variable fields that cannot be blocked without collateral damage, such as power grid failures. We (1) convert TCP traffic to UDP traffic, (2) introduce observation-based FTE, and (3) model interpacket timing with a deterministic Hidden Markov Model (HMM). The resulting Protocol Proxy has a very low probability of detection and is an alternative to current covert channels. We tunnel a TCP session through a UDP protocol and guarantee delivery. Observation-based FTE ensures traffic cannot be detected by traditional rule-based analysis or DPI. A deterministic HMM ensures the Protocol Proxy accurately models interpacket timing to avoid detection by side-channel analysis. Finally, the choice of a protected static protocol foils stateful protocol analysis and causes collateral damage with false positives.
