Towards Optimized TCP/IP Covert Channels Detection, IDS and Firewall Integration

Abstract

Covert channels exist in most communications systems and allow individuals to communicate truly undetectable and exchange hidden information. That's why their detection seems to be a big deal for security systems. However, till now, security systems do not include dedicated processes for covert channel detection. In this paper, we first propose mechanisms to detect common covert channels. Then, within a whole security system, we propose an optimized order regarding the execution of the three major security processes: Firewall, Intrusion Detection System (IDS) and Covert Channel Detection System (CCDS). It will be demonstrated that the proposed order would allow security systems to offer better processing performances.