Chapter 3 Time-to-live Covert Channels - CAIA
Chapter 3 Time-to-live Covert Channels - CAIA
Chapter 3 Time-to-live Covert Channels - CAIA
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS<br />
underestimates the true number of deletions. Hence the inner marker code receiver algo-<br />
rithm is executed multiple times with increasing number of assumed deletions 1 .<br />
Ratzer showed that deterministic markers perform equal or better than random mark-<br />
ers for channels with insertion/deletion rates of less than 1% [180]. We use deterministic<br />
markers as in his work. A marker is a number of zeros followed by a one, for example<br />
“001”. The sender algorithm uses an RS encoder <strong>to</strong> compute error correction data over<br />
header and payload, and then inserts an m bit marker after each n bits.<br />
The receiver first tries <strong>to</strong> identify the positions of the deletions. The algorithm per-<br />
forms a search for a plausible marker sequence with the known number of deletions in the<br />
block as constraint (see Algorithm 3.2). The bits at every assumed marker position are<br />
checked and the number of missing bits is computed. For example, if the used marker is<br />
“001” and the bits checked are “010” then one bit has been deleted between the last and<br />
the current marker. Since marker bits can be corrupted themselves the number of deleted<br />
bits computed is possibly incorrect. Hence for each marker the algorithm also computes<br />
the number of possible bit errors. For example, if the assumed marker is “010” the bit<br />
preceding this sequence must be a zero otherwise a marker bit was deleted or substituted.<br />
The variable offset keeps track of the <strong>to</strong>tal number of deletions identified so far. As<br />
long as the number of errors (<strong>to</strong>tal_errors) is below a threshold (error_threshold)<br />
the number of deletions for the current marker (deletions) is set as indicated by the<br />
assumed marker. However, since there cannot be more deletions than indicated by the<br />
outer marker code, deletions and the error are adjusted if the maximum is exceeded.<br />
If the error exceeds the threshold the algorithm backtracks assuming that mistakes were<br />
made. It backtracks <strong>to</strong> the previous marker with at least one assumed deletion, subtracts<br />
one and then resumes the forward search.<br />
How aggressively the algorithm backtracks depends on error_threshold. The<br />
search is executed multiple times with error_threshold varying from zero <strong>to</strong> the max-<br />
imum value MAX_ERROR_THRESHOLD. We found the choice of MAX_ERROR_THRESHOLD<br />
is not very critical for deletion rates of 1% or less, as long as it is not chosen <strong>to</strong>o small 2 .<br />
After each search the receiver attempts <strong>to</strong> decode the block, unless the search produced<br />
the same solution as before or the algorithm failed <strong>to</strong> converge.<br />
Dummy bits are inserted at the identified positions of deletions and the RS code is<br />
used <strong>to</strong> correct the dummy bits and other substitution errors (see Algorithm 3.3). RS<br />
codes correct errors on a per-symbol basis. This means when inserting dummy bits it<br />
does not matter where inside a symbol they are inserted. If the space between markers<br />
is only one symbol the RS decoder can correct the maximum N − K symbols. However,<br />
if the space between markers is multiple symbols it is unknown in which symbol(s) the<br />
1 In the experiments we assumed a maximum of two such bit insertions.<br />
2 We set MAX_ERROR_THRESHOLD=5 in all experiments.<br />
56