一种基于Xgboost的Skype时间式隐信道检测方法

时间式隐信道利用数据包的包间时延来传递秘密信息,受网络时间特性复杂性的影响,网络隐信道的检测率低且虚警率较高.提出一种利用Xgboost模型的Skype时间式隐信道检测方法.在传统提取Skype时间序列的Markov转移特性、信息熵、包间时延的均值与方差、DCT系数、ε-相似度等特征的基础上,增加峰态、偏态和标准偏差的...

An Xgboost-based Method for Detecting Covert Timing Channel of Skype

The covert timing channel exploits the packet delay to transmit secret information.Due to the complexity of the temporal features of network,the false alarm rate of the covert channels is high,masking the detection of the true targets.An Xgboost-based method for detecting covert timing channel of Skype is proposed.On the basis of the existing methods,which extract the Markov transition features,information entropy,mean and variance of the delay between packets,DCT coefficient,and ε-similarity of the Skype time series,the proposed method adds another three features,including the peak state,skewness and difference of standard deviation,so as to accurately understand the distribution of delay between packets and to screen the targets.At the same time,the method of five-fold cross verification is combined with the non-repeating sampling technology,so that every sample point is classified into training set or test set for only once in each iteration.Finally,the Xgboost algorithm is used for judgment and detection.Experimental results show that compared with the BP neural network method,the proposed method has higher detection rate and lower false alarm rate.