基于数据包时间间隔的隐蔽通道实现及检测方法研究  

Covert Channel Implementation based on Between-Packet Time Intervals and Detection Method

作　　者：姬国珍[1] 谭全福 JI Guo-zhen;TAN Quan-fu(No.30 Institute of CETC, Chengdu Sichuan 610041, China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2018年第1期189-194,共6页Communications Technology

摘　　要：网络隐蔽通道是以网络通信数据为载体,通过将秘密信息隐藏在数据包协议载荷中或者利用数据包的一些特征进行隐蔽传输的手段。网络信息传输面临巨大风险,隐蔽通信已经成为当前研究的热点。因此,通过分析网络数据包的不同属性传递隐蔽信息,以构建隐蔽通道。重点介绍了基于ICMP数据包时间间隔的隐蔽通道构建原理和方法,并实现了此种隐蔽通道,分析了其隐蔽通道传输性能。最后,理论分析了基于时间间隔构建隐蔽通道的检测方法及面临的问题。Network covert channel, with network communication data as the carrier, by hiding the secret information in the packet protocol payload or utilizing some characteristics of the packet, transmits the secret information. Network information transmission faces great risks, and the convert communication now becomes the research hotspot. The covert channel is constructed by analyzing the different attributes of network packets in transferring the hiding information. The construction principle and method of covert channel based on the time interval of ICMP packet are emphatically described, including the implementation of covert channel, and the transmission performance of covert channel also discussed in detail. Finally, the detection method and the problem of covert channel based on time intervals are analyzed theoretically.

关 键 词：隐蔽通道 时间间隔 ICMP报文 检测 

分 类 号：TP97[自动化与计算机技术]