Abstract
Network covert channels are becoming exploited by a wide-range of threats to avoid detection. Such offensive schemes are expected to be also used against IoT deployments, for instance to exfiltrate data or to covertly orchestrate botnets composed of simple devices. Therefore, we illustrate a solution based on Deep Learning for the detection of covert channels targeting the TTL field of IPv4 datagrams. To this aim, we take advantage of an Autoencoder ensemble to reveal anomalous traffic behaviors. An experimentation on realistic traffic traces demonstrates the effectiveness of our approach.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
In this work, we used the collection of IoT traffic made available in [14]. Heatmaps have been computed by using the 24-h slice of data captured from September 22, 2016 at 16:00 to September 23, 2016 at 16:00, whereas for the performance evaluation we used traces containing traffic collected from September 22, 2016 at 16:00 to September 29, 2016 at 16:00.
- 2.
TensorFlow machine learning library. Available online at: https://www.tensorflow.org/ [Last Accessed: June 2022].
References
Ahmad, Z., Khan, A.S., Shiang, C.W., Abdullah, J., Ahmad, F.: Network intrusion detection system: a systematic study of machine learning and deep learning approaches. Trans. Emerg. Telecommun. Technol. 32(1), e4150 (2021)
Alcaraz, C., Bernieri, G., Pascucci, F., Lopez, J., Setola, R.: Covert channels-based stealth attacks in industry 4.0. IEEE Syst. J. 13(4), 3980–3988 (2019)
Antonakakis, M., et al.: Understanding the Mirai botnet. In: 26th USENIX Security Symposium, pp. 1093–1110 (2017)
Bengio, Y., Pascal, L., Dan, P., Larochelle, H.: Greedy layer-wise training of deep networks. In: Advances in Neural Information Processing Systems (NeurIPS), vol. 19, pp. 153–160. MIT Press (2007)
Darwish, O., Al-Fuqaha, A., Brahim, G.B., Jenhani, I., Vasilakos, A.: Using hierarchical statistical analysis and deep neural networks to detect covert timing channels. Appl. Soft Comput. 82, 105546 (2019)
Elsadig, M.A., Gafar, A.: Covert channel detection: machine learning approaches. IEEE Access 10, 38391–38405 (2022)
Folino, G., Guarascio, M., Papuzzo, G.: Exploiting fractal dimension and a distributed evolutionary approach to classify data streams with concept drifts. Appl. Soft Comput. 75, 284–297 (2019)
Hinton, G., Salakhutdinov, R.: Reducing the dimensionality of data with neural networks. Science 313(5786), 504–507 (2006)
Mazurczyk, W., Caviglione, L.: Information hiding as a challenge for malware detection. IEEE Secur. Priv. 13(2), 89–93 (2015)
McLaren, P., Russell, G., Buchanan, B.: Mining malware command and control traces. In: 2017 Computing Conference, pp. 788–794 (2017)
Neshenko, N., Bou-Harb, E., Crichigno, J., Kaddoum, G., Ghani, N.: Demystifying IoT security: an exhaustive survey on IoT vulnerabilities and a first empirical look on Internet-scale IoT exploitations. IEEE Commun. Surv. Tutorials 21(3), 2702–2733 (2019)
Parisi, G.I., Kemker, R., Part, J.L., Kanan, C., Wermter, S.: Continual lifelong learning with neural networks: a review. Neural Networks 113, 54–71 (2019)
Repetto, M., Caviglione, L., Zuppelli, M.: bccstego: a framework for investigating network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–7 (2021)
Sivanathan, A., et al.: Classifying IoT devices in smart environments using network traffic characteristics. IEEE Trans. Mob. Comput. 18(8), 1745–1759 (2018)
Zander, S., Armitage, G., Branch, P.: Covert channels in the IP time to live field. Swinburne University of Technology Report (2006). https://researchrepository.murdoch.edu.au/id/eprint/35012/1/covert. Accessed Jun 2022
Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols. IEEE Commun. Surv. Tutorials 9(3), 44–57 (2007)
Zuppelli, M., Caviglione, L.: pcapstego: a tool for generating traffic traces for experimenting with network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–8 (2021)
Acknowledgment
This work has been partially supported by the Horizon 2020 Program within the framework of CyberSec4Europe (Grant Agreement No. 830929).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Cassavia, N., Caviglione, L., Guarascio, M., Liguori, A., Zuppelli, M. (2022). Ensembling Sparse Autoencoders for Network Covert Channel Detection in IoT Ecosystems. In: Ceci, M., Flesca, S., Masciari, E., Manco, G., Raś, Z.W. (eds) Foundations of Intelligent Systems. ISMIS 2022. Lecture Notes in Computer Science(), vol 13515. Springer, Cham. https://doi.org/10.1007/978-3-031-16564-1_20
Download citation
DOI: https://doi.org/10.1007/978-3-031-16564-1_20
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-16563-4
Online ISBN: 978-3-031-16564-1
eBook Packages: Computer ScienceComputer Science (R0)