You are currently viewing a new version of our website. To view the old version click .
MDPIMDPI
Search all articles
Electronics
Download PDF
  • Article
  • Open Access

22 February 2023

Detecting Parallel Covert Data Transmission Channels in Video Conferencing Using Machine Learning

,
and
1
Information Science Department, Bar-Ilan University, Ramat Gan 5290002, Israel
2
Department of Industrial Engineering and Management, Ariel University, Ariel 4076414, Israel
3
Data Science and Artificial Intelligence Research Center, Ariel Cyber Innovation Center, Ariel University, Ariel 4076414, Israel
*
Author to whom correspondence should be addressed.
Electronics2023, 12(5), 1091;https://doi.org/10.3390/electronics12051091
This article belongs to the Special Issue Network Intrusion Detection Using Deep Learning
Version Notes
Order Reprints

Abstract

Covert communication channels are a concept in which a policy-breaking method is used in order to covertly transmit data from inside an organization to an external or accessible point. VoIP and Video systems are exposed to such attacks on different layers, such as the underlying real-time transport protocol (RTP) which uses Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) packet streams to punch a hole through Network address translation (NAT). This paper presents different innovative attack methods utilizing covert communication and RTP channels to spread malware or to create a data leak channel between different organizations. The demonstrated attacks are based on a UDP punch hole created using Skype peer-to-peer video conferencing communication. The different attack methods were successfully able to transmit a small text file in an undetectable manner by observing the communication channel, and without causing interruption to the audio/video channels or creating a noticeable disturbance to the quality. While these attacks are hard to detect by the eye, we show that applying classical Machine Learning algorithms to detect these covert channels on statistical features sampled from the communication channel is effective for one type of attack.

1. Introduction

The COVID-19 pandemic has rapidly changed the landscape of certain professions and motivated many industries to adopt the concept of remote work [1,2]; even after the COVID-19 restrictions were removed, the usage of virtual meeting technologies such as Voice over Internet Protocol (VoIP) has become the new norm for several organizations after understanding its efficiency in day-to-day work as an alternative to physical meetings. This change in the work environment applies to the private and the government sectors and exposes critical information or infrastructure to a greater surface of attack [3,4,5]. This increased surface results from connecting the internal organization assets to a public domain, such as the Internet, or creating new connections between different organizations required for remote work.
Voice over IP (VoIP) and Video Conferencing (VC) systems, which enable the backbone of remote work methods, are simple to implement. Still, their vulnerability to attacks is greater than traditional telephone services. The audio and video services rely on “rich” communication protocols such as UDP and TCP [1,2], which allows for a substantial attack surface from the ability to traverse between NAT and Firewalls using punch holes, stenographic methods, or creating covert communication channels. Manifesting cyber-attacks on VoIP and VC systems allows the attacker to spread malware inside the attacked domain or leak sensitive data, which is a key challenge in connecting different organizations to the same communication medium [4]. One of the reasons for the increased vulnerability of organizations to cyber-attacks on VoIP and VC systems is that the communication service used for voice or video channels is established by their client systems inside the organizational defense parameter in a way that is regarded as safe since a user authentication method was used to verify its creation.
A covert channel data transmission attack over real-time protocols (RTP) uses the existence of these communication services to covertly create a channel that is reliable and hard to detect using traditional methods without damaging or interrupting existing communication between the parties [6,7]. This challenge is more prominent when connecting closed organizations under different regulations or security guidance. Once any of these organizations have been compromised, meaning that attackers have gotten a foothold in a way that enables them to extract information [8] or run scripts, the communication channel used for VoIP or VC can enable them to expand their control to other closed off organization, making them valuable as well.
This type of Point-to-Point (P2P) architecture is being implemented in various sectors, from government to utilities, and is considered complex to defend and regulate. One common method of ensuring a safe connection between organizations is data filtering on the channel using a data-scheme filter. However, RTP channel filtering requires dedicated hardware and is not a commercial off-the-shelf product. This method of ensuring the security of the connection between the organizations may lead to costly in-house development and is effective to a certain degree. Another method to establish a cross-organization connection is to connect by extending WAN/LAN and the client infrastructure of one of the organizations to the other rather than directly between communication infrastructures, which will limit the accessibility to the end users by creating constraints on the availability of local termination in each of the different sites.
The different approaches to negate the threat of parallel covert transmission channels between organizations is described in Table 1.
Table 1. Secure communication methods comparison.
While Ad Hoc protocol filtering and Rule-Based solutions, such as firewalls, require dedicated hardware and compatibility with different VC software and hardware solutions, a Machine Learning based solution will have a dramatically lower cost of ownership and is agnostic to the VC solution chosen by the organization. The compatibility required and the rule-based nature of these detection systems will have, as stated before, a limited ability to detect parallel covert transmission channels which use a NAT punch hole to avoid a policy-breaking method of attack.
Using Machine Learning to detect is a growing method [9,10,11] in various fields and systems, becoming popular with the rise of distributed applications and systems such as the ones described in the Internet of Things paradigm and its variants [12].
The contribution of the proposed study is twofold. First, we demonstrate an innovative cyber-attack using covert communication on RTP channels, which rely on VoIP or VC applications for network address translation (NAT) traversal. Second, we discuss why defending against this attack with common off-the-shelf tools is so challenging and suggest a simple-to-implement method using classical machine learning (ML) algorithms to detect this covert side-channel communication. The suggested detection method can be implemented easily and provide additional monitoring capabilities on a connection between organizations on either P2P architecture or one created using a third-party call manager and can improve the reliability of more complex detection systems which focus on anomalies in different layers.
The rest of the work is organized as follows: Section 2 details the related work; Section 3 describes the methodology and technical approach; Section 4 describes the simulation and results; the results are described in Section 5. Finally, Section 6 concludes this work.

3. Methodology and Technical Approach

In this section, we introduce the methods by which a covert transmission channel can be established between two different NAT areas representing different organizations, as illustrated in Figure 1. This can be accomplished by a UDP punch hole created by a Skype service. The demonstrated attacks are able to create a parallel communication channel to the legitimate channel in which a file is transferred between the two parties separated by different NAT areas.
Figure 1. Graphical illustration: Parallel covert transmission channel in a point-to-point architecture.
For these attacks, we assume that the attacker has access to one of the clients and is able to plant a script on the other party. The attacker will try and emulate the legitimate channel features by learning them from the legitimate channel to avoid detection. We used the following methodology to simulate different attacks:
  • Learning the features using syntactic data of legitimate traffic features of the RTP protocol (UDP Packet), which are Length and Interval;
  • Applying statical distribution to the packet transmission interval feature using Gaussian spreading and Linear Interpolation;
  • Manually adjusting the packet length feature to the legitimate channel packet length range.
In order to detect the attack, we used classical ML methods over data collected from the communication ports between the parties to establish a reasonable accuracy if a covert communication channel exists.

3.1. Simulating the Attack

3.1.1. Channel Mimicking Using Gaussian Spreading

In our study, channel mimicking using Gaussian Spreading is used to transfer packets covertly on a side channel. The embedded script on client-side B needs to learn the characteristics of the RTP protocol by listening to the VC port; for the Transmission Interval, a random variable with a Gaussian distribution (i.e., normal deviation) is chosen between the values of the legitimate UDP packet lengths. For the Packet Length, a random float is chosen based on the length of the legitimate channel transmission. The transmission interval calculation is expressed through the following equation:
f ( x ) = a · exp − ( x − b ) 2 2 c 2
where:
  • x is the independent variable, representing the new point for the channel mimicking;
  • a is the height of the curve;
  • b is the position of the center of the peak;
  • c is a measure of how wide the curve is, known as the standard deviation The exponent in the equation determines the shape of the curve, The standard deviation (c) determines the width of the curve, with larger values resulting in a wider curve and smaller values resulting in a narrower curve.
Once the side channel is established, based on a UDP punch hole created by the VC service, detecting it using network parameters alone is a challenging task, as can be seen in the 2D spread described in Figure 2. This method only requires the attacker to have a small amount of knowledge about the features of the legitimate channel (Packet Length and Transmission Interval), which are mostly generic per application.
Figure 2. 2D scatter of a Gaussian Spreading based attack.

3.1.2. Channel Mimicking Using Linear Interpolation

A possible alternative is for the embedded script on client-side B to manually mimic the channel using linear interpolation on the transmission interval. The transmission interval is expressed through the following equation:
y = y 1 + ( ( x − x 1 ) / ( x 2 − x 1 ) ) × ( y 2 − y 1 )
where:
  • x is the point at which the function is being estimated, which represents the new point for the channel mimicking;
  • x 1 and x 2 are known points on the function, with x 1 being less than x 2 , which are the points of the legitimate channel;
  • y 1 and y 2 are the values of the function at x 1 and x 2 , respectively;
  • y is the estimated value of the function at x. This equation works by taking the difference between x and x 1 , and scaling it to the range between y 1 and y 2 . The result is then added to y 1 to give the final estimate of the function’s value at x.
The pseudo-code for the method used to mimic the channel using linear interpolation is as follows:
The attack algorithm for mimicking a channel using linear interpolation, described above in Algorithm 1, can be explained as follows:
  • This algorithm takes in two inputs: CDFArray, an array of pairs (X, Y) representing the points on the cumulative distribution function (CDF) curve, and rand, a random float between 0 and 1;
  • x m i n and y m i n are initialized to 0. These variables will later be used to store the value of X and Y from the previous iteration of the loop;
  • Similarly, x m a x and y m a x are initialized to 0. These variables will later be used to store the value of X and Y from the current loop iteration;
  • last is initialized to false. This variable will later be used to track whether the value of Y at the current iteration is greater than rand;
  • The loop iterates through the pairs in CDFArray. At each iteration, the values of X and Y are assigned to the loop variables X and Y, respectively;
  • If last is true, the loop breaks and x m a x and y m a x are set to the values of X and Y at the current iteration;
  • If Y is greater than rand and last is not true, last is set to true and x m i n and y m i n are set to the values of X and Y at the current iteration;
  • The loop ends;
  • The algorithm performs linear interpolation using the values of x m i n , y m i n , x m a x , and y m a x to find the value of the continuous random variable and returns the result.
Algorithm 1 Linear interpolation of channel mimicking
1:
Inputs: C D F A r r a y , r a n d
2:
x m i n ← 0
3:
y m i n ← 0
4:
x m a x ← 0
5:
y m a x ← 0
6:
l a s t ← false
7:
for X , Y in the C D F A r r a y do
8:
    if l a s t then:
9:
         x m a x ← x
10:
         y m a x ← y
11:
        break
12:
    end if
13:
    if  y > r a n d and not l a s t then
14:
         l a s t ← true
15:
         x m i n ← x
16:
         y m i n ← y
17:
    end if
18:
end for
19:
return x m i n + ( x m a x − x m i n ) ∗ ( r a n d − y m i n ) / ( y m a x − y m i n )
Similarly to the previous attack method, the packet length of a random float is chosen based on the length of the legitimate channel transmission. The input for the Linear Interpolation function is the cumulative distribution function (CDF) of the packet sizes can be calculated from the WIRESHARK capture as depicted in Figure 3.
Figure 3. 2D scatter of Linear Interpolation based attack.

3.1.3. Larger Packet Length Reduction for Analysis

As can be seen in Figure 2 and Figure 3, the packet spreading occurs in two major clusters. Large packets with a length greater than 500 and smaller packets with a length lower than 300 (Note that packet length determines the size of the whole packet, including the header, trailer, and the data sent on that packet). This cluster difference results from different traffic types, such as audio and video. For the channel mimicking, we assumed the natural existence of the small packets and ignored the possibility of the larger packet cluster existing naturally in the VC conversation. Since the attacker only targets the small packets, and to better analyze the effect of machine learning analysis of the attack, we have artificially removed the larger packet clusters as can be seen in Figure 4 and Figure 5.
Figure 4. 2D scatter of Gaussian Spreading based attack with only small packets.
Figure 5. 2D scatter of Linear Interpolation Spreading based attack with only small packets.
As can be seen in Figure 4, the Gaussian Spreading algorithm spread is not as tight as the Linear Interpolation spread seen in Figure 5 and would be more likely to be spotted by a security operations center (SOC) operative in reference to a normal traffic 2D scatter pattern.

4. Experimental Design

A set of experiments was conducted to evaluate the effects of the evasion attacks suggested in Section 3. For clarity purposes, we divide this section as follows: first, in Section 4.1, we describe how we empirically generated the datasets used for our experiments. Next, in Section 4.2, we describe the architecture used for our evaluations, list the different ML models used, and discuss the way we ensured robust and unbiased learning. Finally, in Section 4.3, we present the different evaluation metrics based on which we evaluate the ability of classic ML classification models to detect an attack.

4.1. Data Collection

Data were collected using WIRESHARK on client-side A, which received the data from client-side B. The PCAP file representing this data contained the following features—timestamp, length, source and destination IP, and TTL. Using the method mentioned in Section 3.1, we mimicked the packet length using either Gaussian Spread or Linear Interpolation and manually adjusted the transmission interval of the covertly transmitted packets. In addition, we used the time stamp to create an interval feature between the packets, which was further enhanced by replicating it to create a time series (sliding window). The Gaussian Spreading data set contained 4544 packets, of which 354 were covertly transmitted (6%). The Linear Interpolation data set contained 4631 packets, of which 142 were covertly transmitted (3%). Detailed information about the different datasets is described in Table 2.
Table 2. Detailed datasets description.

4.2. Experimental Methodology

The network architecture of the experiment we planned simulated a connection between two different organizations, separated by different internal security regulations and employ network protection such as NAT; this is illustrated in Figure 6. The communication connection between the two parties is established over a public domain infrastructure utilizing two different Internet Service Providers, which employ, to some degree, network protection to defend against unauthorized access to hosts from unauthorized clients or to avoid port forwarding attacks. After setting up the connection, we used Skype, which uses a peer-to-peer connection, to punch-through NAT of the different parties.
Figure 6. Network architecture of the simulated lab setup; Workstation A and Workstation B act as different organizations separated by different ISPs and NATs. TAP A and TAP B helped monitor traffic as the capture point for the datasets.
The connection demonstrated in the experiment simulates the general underlying technical mechanisms used in all VC systems. The Skype channel creates the UDP-based RTP channel, which allows the NAT punch-through and, in addition, acts as the SIP server.
After establishing the authorized connection and the parallel data leak channel based on the NAT punch hole, we designed two evaluations. The evaluations, which were purposed to emulate the features of the authorized channel in parallel to the data leak channel and avoid detection by ML tools, were based on two different attacks described in Section 3.1.
Our evaluation was for the Gaussian spreading dataset and the Linear Interpolation. Each evaluation was conducted using these eight classical ML models (XGBoost, AdaBoost, Random Forest, Gradient Boosting, K-nn, and Decision Tree). To account for variations, the experiments were executed using 10-fold cross-validation in a stratified way, such that the portion of malicious instances was identical on each fold’s test set.

4.3. Evaluation Metrics

To evaluate the models’ performances, we considered well-known metrics commonly used in the literature (accuracy, precision, recall, and F1-score). Note that, in this paper, we tackle imbalanced datasets where accuracy is insufficient. Thus, we also look at the precision, recall, and F 1 - s c o r e . The formal definitions of the above metrics are as follows:
Accuracy: the fraction of the classification samples correctly classified:
A c c u r a c y = T P + T N T P + T N + F P + F N
Recall: the total number of True Positives ( T P ) among all actual positive samples ( T P + F N ):
R e c a l l = T P T P + F N
Precision: The ratio of True Positive ( T P ) samples of the total classifications that were positive ( T P + F P ):
P r e c i s i o n = T P T P + F P
F1-score: a measure of a model’s accuracy on a dataset. It evaluates the binary classification systems, which classify samples as positive or negative. The F 1 - s c o r e combines the Precision and Recall into one metric for the model’s performance according to the harmonic mean of the model’s Precision and Recall:
F 1 - s c o r e = 2 · P r e c i s i o n · R e c a l l P r e c i s i o n + R e c a l l

5. Experimental Results

The data set used for the algorithm comparison was based on the channel mimicking using Gaussian spreading and Linear Interpolation, as described in Section 3.1. Results were obtained using the scikit-learn 1.2.0 API, which offers a variety of machine-learning packages. The results of the different models’ performance are reported for Linear Interpolation-based attack in Table 3 and Table 4 and for Gaussian Spreading-based attack in Table 5 and Table 6.
Table 3. Models’ performance for Linear Interpolation (standard deviation in brackets).
Table 4. Models’ performance for Linear Interpolation with only small packets (standard deviation in brackets).
Table 5. Models’ performance for Gaussian Spreading (standard deviation in brackets).
Table 6. Models’ performance for Gaussian Spreading with only small packets (standard deviation in brackets).
The reduction of the larger packets had a small effect in terms of precision and recall, in which the results for smaller packet sizes were more precise and had a better recall and F1 score in some of the algorithms. Furthermore, one can see that the standard deviation is much higher for the evaluations of the linear interpolation attack, showing that these attack instances are more heterogeneous than the ones generated by the Gaussian Spreading based attack. The combination of the mean and standard deviation allows one to extract further statistical features of each model, such as confidence interval and paired t-test using statistical tools such as [41].
We decided to apply a balanced class weight to the models. Balanced class weight is a technique used to manipulate the error weight in each class by a factor opposite to the ratio of the minority class in the dataset. As a result, using a balanced class weight technique helps improve the model’s performance on the minority class (which is mostly the more important one) and prevents it from being biased towards the more frequent class. The results for the balanced weight are reported for Linear Interpolation based attack in Table 7 and Table 8 and for Gaussian Spreading based attack in Table 9 and Table 10.
Table 7. Models’ performance for Linear Interpolation after applying class weight (standard deviation in brackets).
Table 8. Models’ performance for Linear Interpolation with only small packets after applying class weight (standard deviation in brackets).
Table 9. Models’ performance for Gaussian Spreading after applying class weight (standard deviation in brackets).
Table 10. Models’ performance for Gaussian Spreading with only small packets after applying class weight (standard deviation in brackets).
Using a balanced class weight technique had little to no effect on the overall performance of the different models. In terms of attack, it seems that, in correlation to the 2D scattering in Figure 4 and Figure 5, detecting channel mimicking attacks which are based on Linear Interpolation is more arduous due to the lower accuracy, recall, and precision of the models on the datasets in comparison to the channel mimicking attacks based on Gaussian Spreading.
Most of the algorithms used were able to reach high and near-perfect accuracy.
AdaBoostClassifier has achieved a precision score of 0.98 on the Gaussian Spreading data set and 0.82 on the Linear Interpolation dataset, and a high F1 score, meaning that the number of false alarms is very small. Since the attack packets are being transmitted over a period of time in the covert transmission channel, the lower detection rate will be, to some degree, negated by the number of transmitted attack packets. This argument suggests that the AdaBoost algorithm is more favorable to SOC operation. Still, an ad hoc analysis is required for each organization’s goals in employing a detection system in general.

6. Conclusions and Future Work

The malicious use of a parallel covert communication channel may cause severe damage to traditionally closed organizations, for example, in the defense sector. Data leaks can risk the integrity of plans and data; in addition, the existence of such a channel may allow the surface to conduct service denial attacks via malware spreading. This work has supplied a proven method for detecting parallel covert communication channels using legitimate communication channels punch holes to transmit data between two NAT-separated organizations. Although connecting to a third-party server can mitigate the risk, it is not common in the government sector due to the organizational blind spot it creates, in addition to having its own vulnerabilities to punch hole attacks, making the assessment technocratically valid in various architectures. Although identifying cybersecurity risks in VC or VoIP systems is thoroughly examined, parallel communication channels are mostly overlooked and can be exploited easily; simple and basic ML methods can effectively detect them and at least pose more constraints on an attacker.
The method presented in this work can reduce the attack surface of covert transmission channels using video conferencing communication to leak data or spread malware between different internet-closed organizations or cloud-based solutions towards an on-premise data center environment. However, to better defend the organizational border from embedded attacks or covert transmission, a more holistic approach is required for real-time applications, which often use rich protocols such as UDP and complex data schemes such as video or audio.
Figure 7 illustrates a connection architecture for different organizations not under the same regulation. This particular architecture, in which two or more organizations are connected, poses a threat to each organization involved.
Figure 7. Graphical illustration: Holistic Approach for RTP connection between organizations connected by a demilitarized zone (DMZ).
The holistic approach we offer employs anomaly detection and data scheme filtering for the SIP channel, as well as encrypting RTP channel between the parties. This will, in practice, create more constraints for the attack in creating unauthorized or parallel data leak and spreading channels; these methods, in addition to existing security aspects, already consider basic “off the shelf” tools such as NAT, Firewalls, and Line Encryption. For embedded attacks, a more comprehensive solution will be required, such as video and audio encoding and decoding; this is an ad hoc solution for more threatened organizations and may affect user experience, system performance, and the overall cost of ownership for the solution.
The trade-off between the possible protection level based on the architecture should be correlated to a threat survey conducted by the organization. This survey should reflect the possible risk of creating a connection to different organizations. As previously mentioned, the solution can be based on the simple employment of software solutions such as machine learning for anomaly detection to a third-party demilitarized zone sub-network to manage the connection between the different parties.

7. Limitations

The work presented in this paper described the usage of a parallel covert transmission channel by transmitting a small text file between the endpoints. This demonstration described the general vector of attack using the described method of parallel transmission. The attack has two key limitations, the first being content filtering. In our demonstration, we have transmitted the file as clear text between the endpoints; this method of attack is susceptible to detection, especially when transmitting text files unless the attack encrypts the file before transmission, which requires some encryption algorithm on the end devices. We assume this is of little difficulty and in the realm of possibilities when manifesting the suggested attack. The second limitation is the call duration for transmitting larger files; in order for the transmission to remain covert, it has to be in parallel to an actual legitimate transmission, which in our case is an actual call between two users. In the case of larger files, some form of buffering mechanism will have to be used; this will allow for continuing the transmission on different calls and remain under the assumptions of the channel mimicking.
Even when improving the attack and overcoming these limitations, the statistical features of the channel, i.e., packet length and transmission interval, will remain under the same key assumptions we have described in this work and are still exposed to being detected by the machine learning algorithms we have suggested.

Author Contributions

Conceptualization, O.J.; Methodology, C.H.; Software, O.J. and C.H.; Validation, A.E.; Formal analysis, A.E.; Investigation, O.J.; Resources, A.E.; Data curation, C.H.; Writing—original draft, O.J., A.E. and C.H.; Visualization, O.J.; Supervision, A.E. and C.H.; Project administration, A.E. and C.H. All authors have read and agreed to the published version of the manuscript.

Funding

This research received no external funding.

Institutional Review Board Statement

Not applicable.

Data Availability Statement

Not applicable.

Acknowledgments

We thank Ron Posti (Ben Gurion University of the Negev) and Sean Galantzan (Tel Aviv University) for their assistance with setting up the lab environment and participation in the tests conducted as part of this work.

Conflicts of Interest

The authors declare no conflict of interest.

References

  1. Brynjolfsson, E.; Horton, J.J.; Ozimek, A.; Rock, D.; Sharma, G.; TuYe, H.Y. COVID-19 and Remote Work: An Early Look at US Data; Technical Report; National Bureau of Economic Research: Cambridge, MA, USA, 2020. [Google Scholar]
  2. Marshall, D.T.; Shannon, D.M.; Love, S.M. How teachers experienced the COVID-19 transition to remote instruction. Phi Delta Kappan 2020, 102, 46–50. [Google Scholar] [CrossRef]
  3. Nazih, W.; Hifny, Y.; Elkilani, W.; Abdelkader, T.; Faheem, H. Efficient detection of attacks in SIP based VoIP networks using linear L1-SVM classifier. Int. J. Comput. Commun. Control. 2019, 14, 518–529. [Google Scholar] [CrossRef]
  4. Okereafor, K.; Manny, P. Understanding cybersecurity challenges of telecommuting and video conferencing applications in the COVID-19 pandemic. Int. J. Eng. (IJITE) 2020, 8, 6. [Google Scholar]
  5. Naeem, M.M.; Hussain, I.; Missen, M.M.S. A survey on registration hijacking attack consequences and protection for Session Initiation Protocol (SIP). Comput. Netw. 2020, 175, 107250. [Google Scholar] [CrossRef]
  6. Ru, K.; Zheng, Y.; Feng, X.; Wang, D. The Side-Channel Vulnerability in Network Protocol. In Proceedings of the 2021 the 11th International Conference on Communication and Network Security, Weihai, China, 3–5 December 2021; pp. 1–8. [Google Scholar]
  7. Azadmanesh, M.; Mahdavi, M.; Shahgholi Ghahfarokhi, B. A reliable and efficient micro-protocol for data transmission over an RTP-based covert channel. Multimed. Syst. 2020, 26, 173–190. [Google Scholar] [CrossRef]
  8. Dupasquier, B.; Burschka, S.; McLaughlin, K.; Sezer, S. Analysis of information leakage from encrypted Skype conversations. Int. J. Inf. Secur. 2010, 9, 313–325. [Google Scholar] [CrossRef]
  9. Andoni, M.; Robu, V.; Flynn, D.; Abram, S.; Geach, D.; Jenkins, D.; McCallum, P.; Peacock, A. Blockchain technology in the energy sector: A systematic review of challenges and opportunities. Renew. Sustain. Energy Rev. 2019, 100, 143–174. [Google Scholar] [CrossRef]
  10. Asharf, J.; Moustafa, N.; Khurshid, H.; Debie, E.; Haider, W.; Wahab, A. A review of intrusion detection systems using machine and deep learning in internet of things: Challenges, solutions and future directions. Electronics 2020, 9, 1177. [Google Scholar] [CrossRef]
  11. Abu Al-Haija, Q.; Krichen, M.; Abu Elhaija, W. Machine-learning-based darknet traffic detection system for IoT applications. Electronics 2022, 11, 556. [Google Scholar] [CrossRef]
  12. Heidari, A.; Navimipour, N.J.; Unal, M. A Secure Intrusion Detection Platform Using Blockchain and Radial Basis Function Neural Networks for Internet of Drones. IEEE Internet Things J. 2023, 1. [Google Scholar] [CrossRef]
  13. Semerci, M.; Cemgil, A.T.; Sankur, B. An intelligent cyber security system against DDoS attacks in SIP networks. Comput. Netw. 2018, 136, 137–154. [Google Scholar] [CrossRef]
  14. Wu, Y.S.; Bagchi, S.; Garg, S.; Singh, N. Scidive: A stateful and cross protocol intrusion detection architecture for voice-over-ip environments. In Proceedings of the International Conference on Dependable Systems and Networks, Florence, Italy, 28 June–1 July 2004; IEEE: New York, NY, USA, 2004; pp. 433–442. [Google Scholar]
  15. Olszewski, D. A probabilistic approach to fraud detection in telecommunications. Knowl.-Based Syst. 2012, 26, 246–258. [Google Scholar] [CrossRef]
  16. Kilinc, H.H. A case study on fraudulent user behaviors in the telecommunication network. Electrica 2021, 21, 74–84. [Google Scholar] [CrossRef]
  17. Lin, K.; Jia, C. A punching scheme for crossing NAT in end hopping. Wuhan Univ. J. Nat. Sci. 2012, 17, 539–543. [Google Scholar] [CrossRef]
  18. Halkes, G.; Pouwelse, J. UDP NAT and Firewall Puncturing in the Wild. In Proceedings of the International Conference on Research in Networking; Springer: Cham, Switzerland, 2011; pp. 1–12. [Google Scholar]
  19. Choi, K.; Kong, K.S.; Chung, K.S.; Park, D.S.; Gil, J.M. TTL-Based UDP Hole Punching Scheme in SIP Network. In Multimedia and Ubiquitous Engineering; Springer: Cham, Switzerland, 2014; pp. 147–152. [Google Scholar]
  20. Reddy, T.; Patil, P.; Wing, D.; Ver Steeg, B. Webrtc udp firewall traversal. In Proceedings of the IAB Workshop on Stack Evolution in a Middlebox Internet (SEMI), Zurich, Switzerland, 26–27 January 2015. [Google Scholar]
  21. Gruenter, E.; Meier, M.; Niederberger, R.; Petri, F. Dynamic Configuration of Firewalls Using UDP Hole Punching; Technical Report; D-Grid Integrationsbericht Fachgebiet: Julich, Germany, 2006; pp. 3–5. [Google Scholar]
  22. Ganguly, A.; Boykin, P.O.; Figueiredo, R. Techniques for low-latency proxy selection in wide-area P2P networks. In Proceedings of the 2010 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW), Atlanta, GA, USA, 19–23 April 2010; IEEE: New York, NY, USA, 2010; pp. 1–8. [Google Scholar]
  23. Doğan, F.T. High Throughput Udp-Based Peer-To-Peer Secure Data Transfer. PhD Thesis, Bilkent Universitesi, Ankara, Turkey, 2018. [Google Scholar]
  24. Prasanna, R.; Chandrakumar, C.; Nandana, R.; Holden, C.; Punchihewa, A.; Becker, J.S.; Jeong, S.; Liyanage, N.; Ravishan, D.; Sampath, R.; et al. “Saving Precious Seconds”—A Novel Approach to Implementing a Low-Cost Earthquake Early Warning System with Node-Level Detection and Alert Generation. Informatics 2022, 9, 25. [Google Scholar] [CrossRef]
  25. Oistrez, T.; Grünter, E.; Meier, M.; Niederberger, R. A reliable and fast data transfer for grid systems using a dynamic firewall configuration. In Proceedings of the European Conference on Parallel Processing; Springer: Cham, Switzerland, 2008; pp. 94–102. [Google Scholar]
  26. Gbur, K.Y.; Tschorsch, F. A QUIC (K) Way Through Your Firewall? arXiv 2021, arXiv:2107.05939. [Google Scholar]
  27. Iyengar, J.; Thomson, M. QUIC: A UDP-based multiplexed and secure transport. In RFC 9000; Internet Engineering Task Force (IETF): Fremont, CA, USA, 2021. [Google Scholar]
  28. Chatzoglou, E.; Kouliaridis, V.; Karopoulos, G.; Kambourakis, G. Revisiting QUIC attacks: A comprehensive review on QUIC security and a hands-on study. International J. Inf. Secur. 2022, 1–19. [Google Scholar] [CrossRef]
  29. Joarder, Y.; Fung, C. A Survey on the Security Issues of QUIC. In Proceedings of the 2022 6th Cyber Security in Networking Conference (CSNet), Rio de Janeiro, Brazil, 24–26 October 2022; IEEE: New York, NY, USA, 2022; pp. 1–8. [Google Scholar]
  30. Soni, M.; Rajput, B.S. Security and performance evaluations of QUIC protocol. In Data Science and Intelligent Applications; Springer: Cham, Switzerland, 2021; pp. 457–462. [Google Scholar]
  31. Moyer, D.W. Punching Holes in the Cloud: Direct Communication between Serverless Functions Using NAT Traversal. PhD Thesis, Virginia Tech, Blacksburg, VA, USA, 2021. [Google Scholar]
  32. Thu, H.T.T.; Park, J.; Won, Y.; Kim, J. Combining stun protocol and udp hole punching technique for peer-to-peer communication across network address translation. In Proceedings of the 2014 International Conference on IT Convergence and Security (ICITCS), Beijing, China, 28–30 October 2014; IEEE: New York, NY, USA, 2014; pp. 1–4. [Google Scholar]
  33. Liu, G.; Liu, D.; Hao, S.; Gao, X.; Sun, K.; Wang, H. Ready Raider One: Exploring the Misuse of Cloud Gaming Services. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Copenhagen, Denmark, 26–30 November 2022; pp. 1993–2007. [Google Scholar]
  34. Flaagan, T. Traversing NAT: A Problem. Master’s Thesis, Dakota State University, Madison, SD, USA, 2021. [Google Scholar]
  35. Duarte, E.P., Jr.; Cardoso, K.V.; de Mello, M.O.; Borges, J.G. Beware: NAT Traversal is a Simple and Efficient Approach to Open Firewall Holes. Abakós 2020, 8, 29–41. [Google Scholar] [CrossRef]
  36. Muller, A.; Evans, N.; Grothoff, C.; Kamkar, S. Autonomous nat traversal. In Proceedings of the 2010 IEEE Tenth International Conference on Peer-to-Peer Computing (P2P), Delft, The Netherlands, 25–27 August 2010; IEEE: New York, NY, USA, 2010; pp. 1–4. [Google Scholar]
  37. NAT Slipstreaming v2.0. Available online: https://samy.pl/slipstream/ (accessed on 21 January 2023).
  38. Rekhter, Y.; Moskowitz, B.; Karrenberg, D.; Groot, G.d.; Lear, E. Rfc1918: Address Allocation for Private Internets; Silicon Graphics Inc.: Mountain View, CA, USA, 1996. [Google Scholar]
  39. Circumventing NAT Using UDP Hole Punching. Available online: https://highaltitudehacks.com/2013/06/13/circumventing-nat-using-udp-hole-punching/ (accessed on 21 January 2023).
  40. Zooming in on Zero-click Exploits. Available online: https://googleprojectzero.blogspot.com/2022/01/zooming-in-on-zero-click-exploits.html (accessed on 21 January 2023).
  41. Rodríguez-Fdez, I.; Canosa, A.; Mucientes, M.; Bugarín, A. STAC: A web platform for the comparison of algorithms using statistical tests. In Proceedings of the 2015 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), Istanbul, Turkey, 2–5 August 2015. [Google Scholar]
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Article Metrics

Citations

Article Access Statistics

Journal Statistics
Multiple requests from the same IP address are counted as one view.
Download PDF
An Empirical Survey on Explainable AI Technologies: Recent Trends, Use-Cases, and Categories from Technical and Application Perspectives
Previous
System Identification–Based Adaptive Real-Time Simulators for Power Electronic Converters—Application to Three-Phase and NPC Inverters
Next