Метод програмного виявлення мережевих прихованих каналів для протидії витоку інформації з обмеженим доступом

Abstract

The thesis considers network covert channels as a mechanism of hidden data exfiltration disguised as legitimate network traffic. Storage-based and timing-based channels are analysed, the main indicators for their software detection are identified, and an approach to detection based on statistical, temporal, behavioural and protocol traffic features is proposed. It is shown that the use of a baseline profile of normal network activity and an integrated anomaly score can improve protection against the leakage of restricted information.