一种对抗网络隐蔽存储信道的自适应Warden策略
Adaptive Warden Strategy for Countering Network Covert Storage Channels
摘要：
隐蔽通道的检测和消除由网络节点执行，称为管理员。特别是当面对自适应隐蔽通信方时，与动态监狱长相比，配备静态规范化规则集的常规监狱长是无效的。然而，动态监管者依赖于定期改变规则集，并有自己的局限性，因为他们不考虑流量的具体情况。我们提出了一种新的自适应监狱长策略，能够选择积极的归一化规则，考虑到所观察到的网络流量的特点。我们的目标是扰乱隐蔽通道，并挑起隐蔽的同行暴露自己更多的增加所需的数据包的数量来执行一个成功的隐蔽数据传输。我们的评估表明，自适应监狱长有更好的效率和效果相比，动态监狱长，因为它的自适应选择的规范化规则。
英文摘要：
The detection and elimination of covert channels are performed by a network node, known as a warden. Especially if faced with adaptive covert communication parties, a regular warden equipped with a static set of normalization rules is ineffective compared to a dynamic warden. However, dynamic wardens rely on periodically changing rule sets and have their own limitations, since they do not consider traffic specifics. We propose a novel adaptive warden strategy, capable of selecting active normalization rules by taking into account the characteristics of the observed network traffic. Our goal is to disturb the covert channel and provoke the covert peers to expose themselves more by increasing the number of packets required to perform a successful covert data transfer. Our evaluation revealed that the adaptive warden has better efficiency and effectiveness when compared to the dynamic warden because of its adaptive selection of normalization rules.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
