Detecting Covert Channels in Packet Delays

One of the classic ways to smuggle information out of a watched network is to encode the data in the time delays between packets that are sent.

Vincent Berk, Annarita Giani, and George Cybenko at Dartmouth College just published a technical report with techniques for ferreting out the use of such covert channels.

The problem with these channels, as the paper notes, is that they do not carry a lot of information. The advantage, of course, is that they are nearly invisible to most network managers.