A Covert Channel Based on Web Read-time Modulation

TL;DR

This paper introduces a novel web-based covert channel that encodes information by modulating user read-time, leveraging non-deterministic browsing behavior to evade detection methods used against traditional timing channels.

Contribution

It presents a new covert communication method based on web read-time modulation, differing from existing timing channels by exploiting non-deterministic user behavior.

Findings

Successfully encodes data via web read-time modulation

Resilient against common timing channel detection techniques

Operates without altering deterministic protocol attributes

Abstract

A network covert channel is created that operates by modulating the time between web resource accesses, with an 'average web user' read-time used as a reference. While the covert channel may be classified as timing based, it does not operate by changing deterministic protocol attributes such as inter-packet delay, as do most timing based network covert channels. Instead, our channel communicates by modulating transaction level read-time, which in the web browsing case has significant non-deterministic components. The channel is thus immune to methods typically used to detect timing based network covert channels.