Chapter 3 Time-to-live Covert Channels - CAIA

CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
Table 3.5: Average transmission rates in (kilo) bits/second
Dataset Direct MEI MEI0 MED MED0 DUB AMI
CAIA 71(.99) 71(.99) 65(.99) 71(.99) 65(.99) 64(.98) 65(.99)
Grangenet 68(.99) 68(.99) 59(.94) 68(.99) 59(.94) 61(.98) 62(.99)
Twente 482(.97) 483(.99) 438(.98) 483(.99) 438(.98) 444(.99) 445(.99)
Waikato 1397(.92) 1399(.97) 1096(.89) 1423(.99) 1102(.89) 1200(.97) 1204(.98)
Bell 220(.89) 219(.91) 204(.89) 229(.95) 213(.94) 210(.92) 207(.91)
Leipzig 11.6k(.96) 10.7k(.97) 10.2k(.92) 11.7k(.97) 10.2k(.92) 10.6k(.96) 10.5k(.95)
The transmission rates depend on the capacity in bits per overt packet and the average
packet rates (Equation 3.14). Table 3.5 shows the average transmission rates in bits per
second for all modulation schemes and traces assuming ∆ = 1, no packet loss/reordering
and hop count differences are used for MED, MED0 and AMI schemes 5 . The numbers in
parenthesis denote the capacity in bits per overt packet.
Overall the transmission rates depend on the available overt traffic, varying from tens
of bits per second (CAIA, Grangenet), over hundreds of bits per second (Bell, Twente),
to up to several kilobit per second (Leipzig, Waikato). Besides being standards-compliant
and stealthier our novel schemes (MED, AMI) also have equal or higher transmission
rates than the previous schemes (MEI, DUB). Overall we rank the new schemes as follows
(from best to worst): MED, DED, AMI, MED0.
With increasing packet loss and reordering rate the channel capacity reduces quickly.
Figure 3.15 shows a contour plot of the capacity depending on the loss and reordering
rate if packet loss can be detected (Equation 4.10). Figure 3.16 shows the capacity when
packet loss cannot be detected (Equation 4.9). In both figures pN is the average error rate
for MED with A = 1. For reordering we set b = 1, d = 1, and r = 1/rate − 2 (see Section
3.3), where rate is the reordering rate shown on the x-axis.
3.5.4 Burstiness of errors
The burstiness of errors does not affect the channel capacity, but it affects the performance
of techniques for reliable data transport. On the TTL channel bit errors often occur in
bursts. How bursty the errors are depends on the trace and the modulation scheme.
We illustrate this using results for the MED and AMI modulation schemes and the
CAIA and Leipzig traces. Figure 3.17 shows CDFs of the distance between errors in bits
for the measured errors and simulated uniformly distributed errors with the same probabil-
ities. The empirical error distributions are clearly burstier than the uniform distributions.
5 The transmission rates can be increased by encoding multiple bits per packet or packet pair. However,
as explained earlier this would likely reveal the covert channel.
62