waytotestclaimsorideasaboutagrouporpopulation.
GivenobservationsoftransmissiondataratesubsetsΩ,we
participationΩinton+1subsets{R1,R2,...,Rn,Rc},
correspondingtopossibledataratesetsduetovaryingchannel
conditions,whilethe{Rc}representsdataratesetcausedby
covertcommunications.Thedetectionproblemisformulated
asfollows:
Hp=δ(D)=
⎧
⎪
⎪
⎪
⎨
⎪
⎪
⎪
⎩
H1normal
H2normal
...
Hnnormal
Hccovertchannel
(1)
Here,Hi,i=1,2,...ncorrespondtooneofNULLhy-
pothesis;thealternatehypothesisis{Hc}.Hpisthepredicted
hypothesis.Thechallengehereistofinddecisionruleso
thatthepredictionerrorisminimizedbetweenthepredicted
HpandHi,i=1,2,...nincludingHc.Discriticalvalue.
Wegrouptheoriginalobservationofdataratesetsintotwo
biggroups,arbitrarilylabeledAandB,whicharedifferent
withrespecttosomenumericalcharacteristicsX.InEq.(1),
Hi,i=1,2,...nisconsideredasgroupAandHcisgroup
B.Byanalyzingstatisticsfeatureoforiginaldataratesets,a
featuringvector,consideredasXisformed,andhypotheses
areformedaswell.Inthefollowingsectionwewilldiscuss
howtomapdifferentdataratesets{R1,R2,...,Rn,Rc}to
thecorrespondingHi,Hc,i=1,2,...n;thecriteriaDfor
makingadecision,andthetestprocedure.
C.Theproposeddetectionmodel
802.11a/b/g/nprotocolshavedifferentavailabledatarates
asshowninTableI.Byvaryingmodulationtypes,eachproto-
colallowsadevicechangeitsdataratetoaccommodateunsta-
blewirelessconditions.Rateadaptionisthedeterminationof
theoptimaldatatransmissionratemostappropriateforcurrent
wirelesschannelconditions.Itconsistsofassessingchannel
conditionsandaccordinglyadjustingthetransmissionrate.
Adetailedsurveyonrateadaptionalgorithmscanbefound
in[11].Itisverycommonforadevicetousedifferentdata
ratestotransmitdatainaWLAN,thoughthiscanbeutilized
byanattackertopasssecretmessage.However,justbylooking
atdifferentdataratesusedinaWLANwillnothelpusidentify
anyabnormalcase.Inthispaper,theprobabilitydistribution
oftransmissiondataratesRisproposedtocharacterizerate
diversityinaWLAN.Thischaracteristicsiscalculatedbased
onmeasurementsofdataratesoveracertainperiodoftime.
Thedistributionofdataratesrevealeitherunstablewireless
channelconditionsorapossiblecoverttimingchannel.To
characterizethedynamicfeatureofrateswitchinginaWLAN,
Afeaturevectorisproposedasfollows:
VF=[PR(1),PR(2),...PR(k)](2)
VFisakdimensionalvector,andeachdimensionrep-
resentsaprobabilitydistributionofdatarateRkassuming
therearekdifferentdataratesinaWLAN.Foraspecific
WLAN,notalldataratesareavailable.Inthatcase,missing
datarateisrepresentedby0.NowthestatedhypothesisHiin
Eq.(1)couldbeformedbyVF,representingapossibledata
ratedistributionscenario.EachhypothesisinEq.(1)should
beavectorandboldfaceletterswillbeusedforhypotheses
intheremainderofthispaper.Hicouldbetrainedthrough
realtrafficdata.Hcrepresentsratedistributionpatterncaused
bycovertchannels.Asecretmessageusuallyisnotencrypted
whenitiscarriedbycovertchannelandtheASCIIisencoded
directlybydifferentdatarates.ThehypothesisHcisformed
byletterfrequenciesorwordfrequencies.Letterfrequencies,
howevertendtovarybothbywriterorbysubject.Noexact
letterfrequencydistributionunderliesagivenlanguage,since
allwriterswriteslightlydifferently.Accurateaverageletter
frequenciescanonlybegleanedbyanalyzingalargeamountof
representativetext.Withtheavailabilityofmoderncomputing
andcollectionsoflargetextcorpora,suchcalculationsare
easilymade.TheletterfrequencyfromPavelMika’swebsite,
whichcitesRobertLewand’sCytologicalMathematics,is
adoptedinthispaper.Fig.2showsrelativeletterfrequency.
Arandomtextfileiscreatedwithletterdistributions
followingtheletterfrequencyshowninFig.2.Theselet-
tersarerepresentedbytheirASCIIcodes,whichgiveus
asequencea0sand1s.Dependingonavailabledatarates
inaWLAN,anattackermaypick4differentdatarates
suchasdataratesin802.11b[1,2,5.5,11]Mbpstocodea
secretmessage.Thereare4!=24possibleencodingschemes
toencode00,01,10,11.For8datarates,thenumberof
encodingschemescouldreach8!=40320.Forexample,
datarates1,2,5.5,11Mbpscouldencode00,01,10,11,re-
spectively,whichisoneofmanypossibleencodingschemes.
Thedistributionsofdataratescanthenbecalculatedbasedon
arandomlygeneratedtextmessage.ThusHcrepresentsrate
distributioncausedbycoverttimingchannelsusingdifferent
datarates.TogetaccurateestimationofHc,alargetext
ortheaverageofseveraltextscouldbeusedtoformHc.
FortheHypothesisHi,i=1,2,...n,experimentalmethodis
usedtocharacterizedifferentWLANscenarios.Nowweneed
toproposeacriteriauponwhichwedecidetheclaimbeing
testedbelongstowhichhypothesis.Ifthetestedclaimbelongs
toanyoneofHi,i=1,2,..,nhypothesis,itisanormal
WLANratedistributionscenarioanddoesnotcontainsecret
information;ifitfallsinHc,secretmessageisembedded
intransmissiondatarates.Thus,coverttimingchannelis
detected.Aruntimemonitorcollectssampledataratesfrom
aWLAN;theratedistributionisthencalculatedtoformHp,
whichisakdimensionalvector.Nowwecomparewhatwe
observeinHptowhatweexpectHi,i=1,2...n,Hcinterms
ofsimilarity.ThecriteriaissetbasedonwhichvectoramongHi,i=1,2...n,HcisthemostsimilaronetotheHp.TheEuclideandistanceisproposedtomeasuresimilarity:D(k)=????m