side-channel analysis for detecting protocol tunneling边信道分析隧道检测协议.pdfVIP

Advances in Internet of Things , 2011, 1, 13-26 doi:10.4236/ait.2011.12003 Published Online July 2011 (http://www.SciRP.org/journal/ait) Side-Channel Analysis for Detecting Protocol Tunneling 1 1 1 1 2 Harakrishnan Bhanu , Jason Schwier , Ryan Craven , Richard R. Brooks , Kathryn Hempstalk , Daniele Gunetti3, Christopher Griffin4 1 Holcombe Department of Electrical and Computer Engineering, Clemson University, Clemson, USA 2Department of Computer, The University of Waikato, Hamilton, USA 3Dipartimento di Informatica , Università degli Studi di Torin, Corso Svizzera, Torino, Italy 4Department of Mathematics , Pennsylvania State University, University Park, USA E-mail : rrb@ Received May 28, 2011; revised June 30, 2011; accepted July 8, 2011 Abstract Protocol tunneling is widely used to add security and/or privacy to Internet applications. Recent research has exposed side channel vulnerabilities that leak information about tunneled protocols. We first discuss the timing side channels that have been found in protocol tunneling tools. We then show how to infer Hidden Markov models (HMMs) of network protocols from timing data and use the HMMs to detect when protocols are active. Unlike previous work, the HMM approach we present requires no a priori knowledge of the pro- tocol. To illustrate the utility of this approach, we detect the use of English or Italian in interactive SSH ses- sions. For this example application, keystroke-timing data associates inter-packet delays with keystrokes. We first use clustering to extract discrete information from continuous timing data. We us