基于One-class SVM的网络时间隐蔽信道检测方法

摘要

网络时间隐蔽信道的检测是网络隐蔽信道研究中的热点和难点.当前的网络时间隐蔽信道的检测方法更多是针对某个或者某些特定的网络时间隐蔽信道,不具备通用性.本文利用机器学习中的SVM思想,提出一种基于One-class SVM的通用检测方法.把时间隐蔽信道的检测看作是一种单值分类问题,利用正常信道数据集进行训练,构建分类模型.实验表明该检测方法在保证较高检测率的同时,又具备较好的通用性,可以比较有效地检测出多种网络时间隐蔽信道.%The detection of covert timing channel is the focus and the difficulty of the research on covert channel. Current detec-tions of covert timing channels are more directed against some particular covert timing channels, not all applicable. In this paper, a detection approach based on one-class SVM was introduced. Detection of covert channels is seen as a one-calss calssification problem. The model-building part of the algorithm works trained by the common channel set and generates the classification mod-el. Experimental results show that the detection method can not only ensure a higher detection rate and better versatility, but also effectively detect covert timing channels.