Covert channel detection in the ICMP payload using support vector machine

Taeshik Sohn, Jongsub Moon, Sangjin Lee, Dong Hoon Lee, Jongin Lim

Research output: Chapter in Book/Report/Conference proceedingChapter

22 Citations (Scopus)

Abstract

ICMP traffic is ubiquitous to almost TCP/IP based network. As such, many network devices consider ICMP traffic to be benign and will allow it to pass through, unmolested. So, attackers can generate arbitrary information tunneling in the payload of ICMP packets. To detect a ICMP covert channel, we used SVM which has excellent performance in pattern classification problems. Our experiments showed that the proposed method could detect the ICMP covert channel from normal ICMP traffic using SVM.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
EditorsAdnan Yazici, Cevat Sener
PublisherSpringer Verlag
Pages828-835
Number of pages8
ISBN (Print)3540204091, 9783540397373
DOIs
Publication statusPublished - 2003

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume2869
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint

Dive into the research topics of 'Covert channel detection in the ICMP payload using support vector machine'. Together they form a unique fingerprint.

Cite this