Abstract Information leakage is becoming increasingly serious in today’ s network environment. Faced with increasingly forceful network defence strategies, attackers are also constantly trying to steal important information from systems. As for security researchers, the most troublesome way of information stealing is the covert channel. Generally, the covert channel is divided into the covert storage channel (CSC) and the covert timing channel (CTC). For the covert storage channel, there are already many effective methods to detect it. However, the detection of the covert timing channel is still in the research stage. The basis for implementing the covert timing channel is to control the sending time of packets, so most researches about the covert timing channel detection are based on the time interval between packets. Based on this idea, we refer to the method adopted in the researches of the malicious traffic detection and propose a covert timing channel detection method based on the k-NearestNeighbor (kNN) algorithm. This method uses a series of statistics related to the time interval and payload length as features to train a machine learning model and using 10-fold cross-validation to improve model performance. The experiment result proves that the model has a great detection effect, the detection accuracy is 0.96, and the Area Under Curve (AUC) value the model is 0.9737.

中文翻译：

---

基于时间间隔和载荷长度分析的隐蔽定时信道检测方法

摘要 在当今的网络环境中，信息泄露问题日益严重。面对日益强大的网络防御策略，攻击者也在不断尝试从系统中窃取重要信息。对于安全研究人员来说，最麻烦的信息窃取方式是隐蔽渠道。通常，隐蔽通道分为隐蔽存储通道（CSC）和隐蔽计时通道（CTC）。对于隐蔽存储通道，已经有很多有效的检测方法。然而，隐蔽定时信道的检测仍处于研究阶段。实现隐蔽定时信道的基础是控制数据包的发送时间，因此大多数关于隐蔽定时信道检测的研究都是基于数据包之间的时间间隔。基于这个想法，我们参考恶意流量检测研究中采用的方法，提出了一种基于k-NearestNeighbor（kNN）算法的隐蔽定时信道检测方法。该方法使用与时间间隔和有效载荷长度相关的一系列统计数据作为特征来训练机器学习模型，并使用 10 倍交叉验证来提高模型性能。实验结果证明该模型具有很好的检测效果，检测精度为0.96，模型曲线下面积（AUC）值为0.9737。该方法使用与时间间隔和有效载荷长度相关的一系列统计数据作为特征来训练机器学习模型，并使用 10 倍交叉验证来提高模型性能。实验结果证明该模型具有很好的检测效果，检测精度为0.96，模型曲线下面积（AUC）值为0.9737。该方法使用与时间间隔和有效载荷长度相关的一系列统计数据作为特征来训练机器学习模型，并使用 10 倍交叉验证来提高模型性能。实验结果证明该模型具有很好的检测效果，检测精度为0.96，模型曲线下面积（AUC）值为0.9737。