Covert Channel Detection Using Process Query Systems Annarita Giani - - PowerPoint PPT Presentation

▶
covert channel detection using process query systems
SMART_READER_LITE
LIVE PREVIEW

Covert Channel Detection Using Process Query Systems Annarita Giani - - PowerPoint PPT Presentation

Aug 12, 2023 44 likes •237 views

Covert Channel Detection Using Process Query Systems Annarita Giani Vincent Berk George Cybenko Institute for Security Technology Studies Thayer School of Engineering Dartmouth College Hanover, NH FLoCon 2005 1 MOTIVATION CNN.COM

slide-1
SLIDE 1

1

Covert Channel Detection Using Process Query Systems

Annarita Giani Vincent Berk George Cybenko

FLoCon 2005

Institute for Security Technology Studies Thayer School of Engineering Dartmouth College Hanover, NH

slide-2
SLIDE 2

2

MOTIVATION

Interest in network and computer security Started investigating DATA EXFILTRATION COVERT CHANNELS are the most subtle way of moving data. They easily bypass current security tools. Until now there has not been enough interest. So detection is still at the first stage.

NEW YORK -- The names, banks and account numbers of up to 40 million credit card holders may have been accessed by an unauthorized user, MasterCard International Inc. said.

CNN.COM Sunday, June 19, 2005 Posted: 0238 GMT (1038 HKT)

slide-3
SLIDE 3

3

OUTLINE

  • Covert Channels
  • Process Query Systems
  • Detection of covert channels using a PQS

“A communication channel is covert if it is neither designed nor intended to transfer information at all.” (Lampson 1973) “Covert channels are those that use entities not normally viewed as data objects to transfer information from one subject to another.” (kemmerer 1983)

slide-4
SLIDE 4

4

EXAMPLE: TIMING COVERT CHANNEL

sec T t =

  • 1

1 INTERNET

t t

  • =
  • 2

Sender Remote Receiver

Noisy Channel

Since brass, nor stone, nor earth, nor boundless sea, But sad mortality

  • 'er-sways their power,

How with this rage shall beauty hold a plea,

1 1

Since brass, nor stone, nor earth, nor boundless sea, But sad mortality

  • 'er-sways their power,

How with this rage shall beauty hold a plea, 1. Information Theory 2. Statistical analysis

Two approaches

t t

  • =
  • 2

sec T t =

  • sec

T t =

  • sec

T t =

slide-5
SLIDE 5

5

We built a package that registers the time delays between consecutive packets for every network traffic flow.

source ip: 129.170.248.33 dest ip: 208.253.154.210 source port: 44806 dest port: 23164 Protocol: TotalSize: #Delays[20]: 3 0 0 16 882 2 0 17 698 2 0 0 1 0 1 0 0 0 0 0

Average delay: Cmax; Cmean:

Traffic is separated in connection types

Sensor

3 delays between 0sec and 1/40sec 882 delays between 4/40sec and 5/40sec

Key Attributes

Given an interval of time we build the following node:

slide-6
SLIDE 6

6

Assumptions of the experiments:

  • No malicious noise.
  • Binary source.

Delay - secs Number of Delays source ip: 129.170.248.33 dest ip: 208.253.154.210 source port: 56441 dest port: 23036 Delay - secs Number of Delays

Covert Channels

source ip: 129.170.248.33 dest ip: 208.253.154.210 source port: 56441 dest port: 23041

slide-7
SLIDE 7

7

OUTLINE

  • Covert Channels
  • Process Query Systems
  • Detection of covert channels using a PQS
slide-8
SLIDE 8

8

Process Query Systems for Homeland Security

  • How it works:
  • User provides a process description as query
  • PQS monitors a stream of sensor data
  • PQS matches sensor data with registered queries
  • A match indicates that the process model may explain that

sensor data, hence that process may be the cause of those sensor readings.

slide-9
SLIDE 9

9

  • Tactical C4ISR - Is there a large ground vehicle convoy moving towards our

position?

  • Cyber-security - Is there an unusual pattern of network and system calls on

a server?

  • Autonomic computing - Is my software operating normally?
  • Plume detection – where is the source of a hazardous chemical plume?
  • FishNet – how do fish move?
  • Insider Threat Detection - Is there a pattern of unusual document accesses

within the enterprise document control system?

  • Homeland Security - Is there a pattern of unusual transactions?
  • Business Process Engineering - Is the workflow system working normally?
  • Stock Market
  • …

Applications

All are “adversarial” processes, not cooperative so the observations are not necessarily labeled for easy identification and association with a process!

slide-10
SLIDE 10

10

Example

Multiple Processes λ1 = router failure λ2 = worm λ3 = scan Events …….

Time

An Operational Network

consists of that produce

Unlabelled Sensor Reports …….

Time

that are seen as

Track 1 Track 2 Track 3

Hypothesis 1

Track 1 Track 2 Track 3

Hypothesis 2

that PQS resolves into that detect complex attacks and anticipate the next steps

129.170.46.3 is at high risk 129.170.46.33 is a stepping stone ......

that are used to defend the network

1 2 3 4 5 6 Indictors and Warnings

Real World PQS

Hypotheses Track Scores Sample Console

slide-11
SLIDE 11

11

Stream of Observable Events SET OF MODELS MODEL LIKELIHOODS TRACKING ALGORITHMS

PQS

slide-12
SLIDE 12

12

TRACKING ALGORITHMS

PQS

Kinematic of a car Kinematic of a bycicle Kinematic of an airplane

Position over time Likelihood of a car = 0.2 Likelihood of an aiplane = 0.01 Likelihood of a bycicle = 0.5 Multiple Hypothesis Tracking Viterbi Algorithm

slide-13
SLIDE 13

13

OUTLINE

  • Covert Channels
  • Process Query Systems
  • Detection of covert channels using a PQS
slide-14
SLIDE 14

14

Observations

source ip: 129.170.248.33 dest ip: 208.253.154.210 source port: 44806 dest port: 23164 source ip: 129.170.248.33 dest ip: 208.253.154.210 source port: 44806 dest port: 23164

max

C Cmean

max

C Cmean

Time T Time T+1

slide-15
SLIDE 15

15 Covert channel

Covert Channels models

Delay - secs Number of Delays

1 ) (

max

<< << C C µ Covert Channel

= max number of packets with the same delay ( = 280)

= ) C(ì

number of packets with interpacket delay ( = 0 ) = µ

sample mean of interpacket transmission times ( = 0.7)

max

C

1 ) (

max

  • C

C µ

Not Covert Channel

slide-16
SLIDE 16

16

RESULTS

max

C Cmean

Bytes

slide-17
SLIDE 17

17

Exfiltration modes:

  • SSH
  • HTTP
  • FTP
  • Email
  • Covert Channel
  • Phishing
  • Spyware
  • Pharming
  • Writing to media
  • paper
  • drives
  • etc

Increased outbound data

Normal activity Scanning Infection Data Access

Low Likelihood of Malicious Exfiltration High Likelihood of Malicious Exfiltration Also monitor inter- packet delays for covert channels

DATA EXFILTRATION

Flow Sensor Ouputs

slide-18
SLIDE 18

18

Flow Sensor Samba Snort Tripwire Snort IP Tables

Exfiltration

Data Access

Scanning Infection

PQS PQS PQS PQS PQS TIER 1 TIER 1 Models TIER 1 Observations TIER 1 Hyphotesis TIER 2 TIER 2 Models TIER 2 Observations TIER 2 Hyphotesis

Preprocessing Node Preprocessing Node Preprocessing Node Preprocessing Node

Events Events Events Events Models

RESULTS

Hierarchical PQS Architecture

slide-19
SLIDE 19

19

annarita.giani@dartmouth.edu vincent.berk@dartmouth.edu george.cybenko@dartmouth.edu

Thanks.

www.pqsnet.net www.ists.dartmouth.edu

For more information :