Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection appr...Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection approaches use either signature-based approaches to detect known TCs or anomaly-based approach by modeling the legitimate network traffic in order to detect unknown TCs. Un-fortunately, in a software-defined networking (SDN) environment, most existing TC detection approaches would fail due to factors such as volatile network traffic, imprecise timekeeping mechanisms, and dynamic network topology. Furthermore, stealthy TCs can be designed to mimic the legitimate traffic pattern and thus evade anomalous TC detection. In this paper, we overcome the above challenges by presenting a novel framework that harnesses the advantages of elastic re-sources in the cloud. In particular, our framework dynamically configures SDN to enable/disable differential analysis against outbound network flows of different virtual machines (VMs). Our framework is tightly coupled with a new metric that first decomposes the timing data of network flows into a number of using the discrete wavelet-based multi-resolution transform (DWMT). It then applies the Kullback-Leibler divergence (KLD) to measure the variance among flow pairs. The appealing feature of our approach is that, compared with the existing anomaly detection approaches, it can detect most existing and some new stealthy TCs without legitimate traffic for modeling, even with the presence of noise and imprecise timekeeping mechanism in an SDN virtual environment. We implement our framework as a prototype system, OBSERVER, which can be dynamically deployed in an SDN environment. Empirical evaluation shows that our approach can efficiently detect TCs with a higher detection rate, lower latency, and negligible performance overhead compared to existing approaches.展开更多
在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络...在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络持续性隐蔽威胁深度检测方法。采用生成对抗网络根据持续性隐蔽威胁攻击特点生成接近真实船用网络的持续性隐蔽威胁攻数据样本。利用长短期记忆网络捕捉船用网络流量中的长期依赖关系,精准识别潜在威胁并输出深度检测结果。实验结果表明,生成样本与真实样本的相似度得分保持在0.9以上,证明了本文方法数据样本生成的质量较高。对于不同船用网络传输距离,攻击链完整度高于70%的阈值,说明本文方法的检测精度较高,能够为船用网络安全防护提供有力的技术支持。展开更多
文摘Despite extensive research, timing channels (TCs) are still known as a principal category of threats that aim to leak and transmit information by perturbing the timing or ordering of events. Existing TC detection approaches use either signature-based approaches to detect known TCs or anomaly-based approach by modeling the legitimate network traffic in order to detect unknown TCs. Un-fortunately, in a software-defined networking (SDN) environment, most existing TC detection approaches would fail due to factors such as volatile network traffic, imprecise timekeeping mechanisms, and dynamic network topology. Furthermore, stealthy TCs can be designed to mimic the legitimate traffic pattern and thus evade anomalous TC detection. In this paper, we overcome the above challenges by presenting a novel framework that harnesses the advantages of elastic re-sources in the cloud. In particular, our framework dynamically configures SDN to enable/disable differential analysis against outbound network flows of different virtual machines (VMs). Our framework is tightly coupled with a new metric that first decomposes the timing data of network flows into a number of using the discrete wavelet-based multi-resolution transform (DWMT). It then applies the Kullback-Leibler divergence (KLD) to measure the variance among flow pairs. The appealing feature of our approach is that, compared with the existing anomaly detection approaches, it can detect most existing and some new stealthy TCs without legitimate traffic for modeling, even with the presence of noise and imprecise timekeeping mechanism in an SDN virtual environment. We implement our framework as a prototype system, OBSERVER, which can be dynamically deployed in an SDN environment. Empirical evaluation shows that our approach can efficiently detect TCs with a higher detection rate, lower latency, and negligible performance overhead compared to existing approaches.
文摘在船用网络流量中,持续性隐蔽威胁具有隐蔽性强、持续时间长等特点,传统检测方法难以检测这种长期依赖关系。为了提高深度检测的可靠性,设计基于GAN-LSTM(Generative Adversarial Networks-Long Short Term Memory Networks)的船用网络持续性隐蔽威胁深度检测方法。采用生成对抗网络根据持续性隐蔽威胁攻击特点生成接近真实船用网络的持续性隐蔽威胁攻数据样本。利用长短期记忆网络捕捉船用网络流量中的长期依赖关系,精准识别潜在威胁并输出深度检测结果。实验结果表明,生成样本与真实样本的相似度得分保持在0.9以上,证明了本文方法数据样本生成的质量较高。对于不同船用网络传输距离,攻击链完整度高于70%的阈值,说明本文方法的检测精度较高,能够为船用网络安全防护提供有力的技术支持。
