Based On Variable Precision Rough Set Network Covert Channel Detection

Network covert channel is the expansion of covert channel in the stand-alone system, and also is an important branch in the field of information hiding, which is a very subtle information transmission mechanism using the resources that not designed for passing secret information with the violation of system security policy. Some hackers embed Trojans through a variety of ways to computer, and then remotely control the Trojans to spread out secret information through the covert channel. So Trojans technology combined with network covert channel for stealing information pose a grave threat to the network information security.Since 1973, B. Lampson proposed the concept of covert channel, people have done a lot of research on covert channel. With the rapid development of the network, covert channel has spread to the computer network, which has been called network covert channel. Since the construction of network covert channels has various ways, which can be based on different levels of protocols and different construction methods, so at present there is no a universal and efficient detection model of network covert channels. Therefore, to explore a new detection method of network covert channel has great significance.At first this paper introduces the basic principles of the network and the status of the detection of covert channel at home and abroad. And the variable precision rough set theory and the data mining methods on it were introduced. Then we sum up the existing network covert channel detection methods. By summarizing the existing construction methods of network covert channel and analyzing characteristics of the covert channel based on different network protocols, a model of detection of network covert channel based on variable precision rough sets theory is proposed, and then discusses the principles and design method of this model in detail. Then, we take network covert channel based on HTTP as an example, to analyze the characteristics of property, and then to quantify, given the specific analysis and design methods. Finally, we experimentally verified the proposed detection method.