Network covert channels detection method for packet data transmission networks security increase

Abstract

The purpose of this paper is to describe the developed method of detecting network covert timing channels, based on machine learning algorithms. Detection of network covert channels is an actual problem, since the latter can be used to leak confidential information. One of the approaches to its solution is the use of machine learning algorithms. In order to apply machine learning algorithms in solving the detection problem, the network traffic under study must be pre-processed. The article describes the developed detection method, where it is proposed to use distributed big data processing methods implemented in Apache Spark to process network traffic. As a machine learning algorithm in the detection method, it is proposed to use gradient boosting over decision trees. The paper describes the architecture of the system in which it is proposed to implement the process of detecting covert channels. The dependences of network traffic processing time on various system parameters are investigated. It is proposed to use new features to detect covert channels. According to the research results, it has been revealed that the proposed method makes it possible to effectively detect network covert channels, and its feature is the speed of detection - through the use of distributed data processing technologies, and increasing accuracy - by adding new features.