{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T10:48:18Z","timestamp":1772448498164,"version":"3.50.1"},"reference-count":35,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2020,4,24]],"date-time":"2020-04-24T00:00:00Z","timestamp":1587686400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Covert timing channels are an important alternative for transmitting information in the world of the Internet of Things (IoT). In covert timing channels data are encoded in inter-arrival times between consecutive packets based on modifying the transmission time of legitimate traffic. Typically, the modification of time takes place by delaying the transmitted packets on the sender side. A key aspect in covert timing channels is to find the threshold of packet delay that can accurately distinguish covert traffic from legitimate traffic. Based on that we can assess the level of dangerous of security threats or the quality of transferred sensitive information secretly. In this paper, we study the inter-arrival time behavior of covert timing channels in two different network configurations based on statistical metrics, in addition we investigate the packet delaying threshold value. Our experiments show that the threshold is approximately equal to or greater than double the mean of legitimate inter-arrival times. In this case covert timing channels become detectable as strong anomalies.<\/jats:p>","DOI":"10.3390\/s20082417","type":"journal-article","created":{"date-parts":[[2020,4,24]],"date-time":"2020-04-24T11:42:14Z","timestamp":1587728534000},"page":"2417","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["Covert Timing Channel Analysis Either as Cyber Attacks or Confidential Applications"],"prefix":"10.3390","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4090-3736","authenticated-orcid":false,"given":"Shorouq","family":"Al-Eidi","sequence":"first","affiliation":[{"name":"Computer Science Department, Memorial University of Newfoundland, St. John\u2019s, NL A1B 3R7, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8346-7148","authenticated-orcid":false,"given":"Omar","family":"Darwish","sequence":"additional","affiliation":[{"name":"Computer Information System Department, Ferrum College, Ferrum, VA 24088, USA"}]},{"given":"Yuanzhu","family":"Chen","sequence":"additional","affiliation":[{"name":"Computer Science Department, Memorial University of Newfoundland, St. John\u2019s, NL A1B 3R7, Canada"}]}],"member":"1968","published-online":{"date-parts":[[2020,4,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Denney, K., Uluagac, A.S., Akkaya, K., and Bhansali, S. (2016, January 9\u201312). A novel storage covert channel on wearable devices using status bar notifications. Proceedings of the 2016 13th IEEE Annual Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, USA.","DOI":"10.1109\/CCNC.2016.7444898"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"477","DOI":"10.1109\/TIFS.2013.2238930","article-title":"A timing channel spyware for the CSMA\/CA protocol","volume":"8","author":"Kiyavash","year":"2013","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_3","unstructured":"Mileva, A., Velinov, A., and Stojanov, D. (2018, January 16\u201320). New Covert Channels in Internet of Things. Proceedings of the 12th International Conference on Emerging Security Information, Systems and Technologies (SECURWARE), Venice, Italy."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Ven\u010dkauskas, A., Morkevicius, N., Bagdonas, K., Dama\u0161evi\u010dius, R., and Maskeli\u016bnas, R. (2018). A lightweight protocol for secure video streaming. Sensors, 18.","DOI":"10.3390\/s18051554"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"38","DOI":"10.1109\/MWC.2017.1800062","article-title":"Covert timing channels for IoT over mobile networks","volume":"25","author":"Tan","year":"2018","journal-title":"IEEE Wirel. Commun."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Islam, M.N., Patil, V.C., and Kundu, S. (2017, January 14\u201315). Determining proximal geolocation of IoT edge devices via covert channel. Proceedings of the 2017 18th International Symposium on Quality Electronic Design (ISQED), Santa Clara, CA, USA.","DOI":"10.1109\/ISQED.2017.7918316"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"292","DOI":"10.1109\/TSE.1987.233153","article-title":"Covert Channels in LAN\u2019s","volume":"13","author":"Girling","year":"1987","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Padlipsky, M., Snow, D., and Karger, P. (1978). Limitations of End-to-End Encryption in Secure Computer Networks, Mitre Corp.. Technical Report.","DOI":"10.21236\/ADA059221"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Cabuk, S., Brodley, C.E., and Shields, C. (2004, January 25\u201329). IP covert timing channels: Design and detection. Proceedings of the 11th ACM Conference on Computer And Communications Security, Washington, DC, USA.","DOI":"10.1145\/1030083.1030108"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"785","DOI":"10.1016\/j.cose.2009.05.006","article-title":"A study of on\/off timing channel based on packet delay distribution","volume":"28","author":"Yao","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_11","unstructured":"Berk, V., Giani, A., Cybenko, G., and Hanover, N. (2005). Detection of covert channel encoding in network packet delays. Rapport Technique TR536, de lUniversit\u00e9 de Dartmouth."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Wolf, M. (1989). Covert channels in LAN protocols. Local Area Network Security Workshop, Springer.","DOI":"10.1007\/3-540-51754-5_33"},{"key":"ref_13","unstructured":"Cabuk, S. (2006). Network Covert Channels: Design, Analysis, Detection, and Elimination. [Ph.D. Thesis, Purdue University]."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Gianvecchio, S., Wang, H., Wijesekera, D., and Jajodia, S. (2008). Model-based covert timing channels: Automated modeling and evasion. International Workshop on Recent Advances in Intrusion Detection, Springer.","DOI":"10.1007\/978-3-540-87403-4_12"},{"key":"ref_15","unstructured":"Shah, G., Molina, A., and Blaze, M. (2006). Keyboards and Covert Channels. Proceedings of the 15th Conference on USENIX Security Symposium, USENIX Association."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Sellke, S.H., Wang, C.C., Bagchi, S., and Shroff, N. (2009, January 19\u201325). TCP\/IP timing channels: Theory to implementation. Proceedings of the IEEE INFOCOM 2009, Rio de Janeiro, Brazil.","DOI":"10.1109\/INFCOM.2009.5062145"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Jaber, M., Cascella, R.G., and Barakat, C. (2011, January 5\u20139). Can we trust the inter-packet time for traffic classification?. Proceedings of the 2011 IEEE International Conference on Communications (ICC), Kyoto, Japan.","DOI":"10.1109\/icc.2011.5963024"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"9292","DOI":"10.1109\/ACCESS.2018.2802783","article-title":"A covert channel over volte via adjusting silence periods","volume":"6","author":"Zhang","year":"2018","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"270","DOI":"10.1109\/MNET.001.1900289","article-title":"Physical-layer network coding: An efficient technique for wireless communications","volume":"34","author":"Chen","year":"2019","journal-title":"IEEE Netw."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1551","DOI":"10.1109\/TIFS.2018.2797953","article-title":"A covert queueing channel in fcfs schedulers","volume":"13","author":"Ghassami","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_21","unstructured":"Qu, H., Su, P., and Feng, D. (2004, January 11\u201314). A typical noisy covert channel in the IP protocol. Proceedings of the 38th Annual 2004 International Carnahan Conference on Security Technology, Albuquerque, NM, USA."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Lucena, N.B., Lewandowski, G., and Chapin, S.J. (2005). Covert channels in IPv6. International Workshop on Privacy Enhancing Technologies, Springer.","DOI":"10.1007\/11767831_10"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/COMST.2007.4317620","article-title":"A survey of covert channels and countermeasures in computer network protocols","volume":"9","author":"Zander","year":"2007","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Liu, Y., Ghosal, D., Armknecht, F., Sadeghi, A.R., Schulz, S., and Katzenbeisser, S. (2010). Robust and undetectable steganographic timing channels for iid traffic. International Workshop on Information Hiding, Springer.","DOI":"10.1007\/978-3-642-16435-4_15"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1007\/s004220050414","article-title":"Measuring regularity by means of a corrected conditional entropy in sympathetic outflow","volume":"78","author":"Porta","year":"1998","journal-title":"Biol. Cybern."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"785","DOI":"10.1109\/TDSC.2010.46","article-title":"An entropy-based approach to detecting covert timing channels","volume":"8","author":"Gianvecchio","year":"2010","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Darwish, O., Al-Fuqaha, A., Anan, M., and Nasser, N. (2015, January 24\u201328). The role of hierarchical entropy analysis in the detection and time-scale determination of covert timing channels. Proceedings of the 2015 International Wireless Communications and Mobile Computing Conference (IWCMC), Dubrovnik, Croatia.","DOI":"10.1109\/IWCMC.2015.7289074"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Darwish, O., Al-Fuqaha, A., Brahim, G.B., and Javed, M.A. (2017, January 26\u201330). Using MapReduce and hierarchical entropy analysis to speed-up the detection of covert timing channels. Proceedings of the 2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC), Valencia, Spain.","DOI":"10.1109\/IWCMC.2017.7986439"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1109\/TDSC.2015.2423680","article-title":"A support vector machine-based framework for detection of covert timing channels","volume":"13","author":"Shrestha","year":"2015","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zander, S., Armitage, G., and Branch, P. (2011). Stealthier inter-packet timing covert channels. International Conference on Research in Networking, Springer.","DOI":"10.1007\/978-3-642-20757-0_36"},{"key":"ref_31","unstructured":"Iglesias, F., and Zseby, T. (September, January 29). Are network covert timing channels statistical anomalies?. Proceedings of the 12th International Conference on Availability, Reliability and Security, Reggio Calabria, Italy."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"225","DOI":"10.13052\/jcsm2245-1439.632","article-title":"Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic","volume":"6","author":"Annessi","year":"2017","journal-title":"J. Cyber Secur. Mobil."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"105546","DOI":"10.1016\/j.asoc.2019.105546","article-title":"Using hierarchical statistical analysis and deep neural networks to detect covert timing channels","volume":"82","author":"Darwish","year":"2019","journal-title":"Appl. Soft Comput."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1109\/TCOMM.2018.2867493","article-title":"Finite-length construction of high performance spatially-coupled codes via optimized partitioning and lifting","volume":"67","author":"Esfahanizadeh","year":"2018","journal-title":"IEEE Trans. Commun."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1109\/MVT.2019.2903343","article-title":"Outage-limit-approaching channel coding for future wireless communications: Root-protograph low-density parity-check codes","volume":"14","author":"Fang","year":"2019","journal-title":"IEEE Veh. Technol. Mag."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/8\/2417\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T14:27:09Z","timestamp":1760365629000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/8\/2417"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,24]]},"references-count":35,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2020,4]]}},"alternative-id":["s20082417"],"URL":"https:\/\/doi.org\/10.3390\/s20082417","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,4,24]]}}}