Effective Detection of Multimedia Protocol Tunneling using Machine Learning
summary
Compares three tools Facet, CovertCast, DeltaShaper using 1,000 Skype traces for Facet (1,000 cover), 300/300 for DeltaShaper, 200/200 for CovertCast; finds decision‑tree models (XGBoost) detect covert channels far better than prior similarity tests — e.g., to block 90% of Facet traffic similarity tests incur 45–84% false positives but XGBoost with quantized packet lengths drops false positives to ~2%; packet‑size features dominate; unsupervised methods score poorly (AUC ~0.56–0.70).
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:19Internet censorship
- 1:03Screening
- 2:25Tunneling
- 6:03Methodology
- 8:06Experimental Setup
- 9:51Results
- 10:37Tradeoffs
- 11:53Feature Sets
- 13:30Analysis
- 16:28Results DeltaShaper
- 17:29Conclusion
related talks
22mProbabilistic Spying on Encrypted Tunnels
14mEndangered Privacy: Large-Scale Monitoring of Video Streaming Services
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
29mYou Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.
51mHow to Detect Malware in Encrypted Traffic WITHOUT Decryption
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
53mCall Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud