Application Layer Covert Channel Analysis and ... - Bill Buchanan

More documents

Recommendations

Info

Z. Kwecka, BSc (Hons) Network Computing, 2006 46server. Here if the requests do not follow the major rules set by HTTP specification,they will be ignored. However, this is a vital part of the detection process, whichcould a large number of covert-channels’ implementations with minimal processingrequired.5.6 ConclusionsDue to the time restrictions of this project only the Inline Filtering Agent has beenimplemented out of the original design of the prototype. However, implementation ofa filtering Proxy server was previously (Chapter 4) identified as the first and mostimportant step in protection against threats to information confinement posed bycovert channels. Additionally set of test software tools was successfully implemented,and the experiments could proceed to collect data for analyse of the validity of theproposed solution to problem.
Z. Kwecka, BSc (Hons) Network Computing, 2006 476 Experiment Data Analysis6.1 IntroductionThe experiments performed in the due course of this project are unique, since theliterature review (Chapter 3) did not identify similar experiments being conducted bythe various teams working on information confinement problem. This chapter willdiscuss how the results were collected from the test network and identify the keyfindings.6.2 ExperimentsThis section describes the results of the seven different experiments, which were conducted for theneeds of this dissertation.6.2.1 Experiment 1 – Implementation Specific Data GatheringThe aim of this experiment was to learn signatures of different HTTP clients. Wehave limited a number of clients to four most common Web browsers (InternetExplorer, Firefox, Opera and Netscape). In the experiment all four host machinesfrom the implemented test network were used. Thus, each host has had followingbrowsers installed:- Internet Explorer version 6.0 SP 2- Mozilla Firefox version 1.5.0.3- Netscape version 8.1- Opera version 8.53No Proxy server was used during this experiment, since we were trying to establishstandard behavior of the browsers. Thus, Browser Caller was used to generate traffic,and HTTP Dumper was used locally to save the traffic into tcpdump files. As theresult we have established syntax employed by the browsers to produce HTTPrequests. See Figure 6-1 for an illustration of percentage usage of various headers bydifferent browsers.
Page 1 and 2: Application Layer Covert ChannelAna
Page 3 and 4: Z. Kwecka, BSc (Hons) Network Compu
Page 11: Z. Kwecka, BSc (Hons) Network Compu
Page 97 and 98:
Z. Kwecka, BSc (Hons) Network Compu
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113:
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138:
show all

Application Layer Covert Channel Analysis and ... - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?