AACL-Detect: a framework for detecting network covert timing channels via average arithmetic coding length

Abstract Network Covert Timing Channel is an attack technique that covertly transmits information by manipulating inter-packet delays, characterized by strong stealth and potential harm. This paper proposes a general detection framework for network covert timing channels, termed AACL-Detect, based on compressibility feature extraction. The method identifies covert channels by leveraging the differences between legitimate and covert traffic in terms of short-term timing behavior and compressibility. Specifically, it discretizes the IPD sequence into a symbol sequence, compresses it using arithmetic coding, and extracts the average arithmetic coding length as a discriminative feature, which is then fed into a LightGBM classifier for training and prediction. Experimental results demonstrate that this feature effectively captures the compressibility differences between legitimate and covert traffic, enabling the detection of four typical covert timing channels. Compared with existing deep learning-based methods, AACL-Detect achieves higher detection accuracy on the newly proposed ϵ - κ libur and ϵ - κ libur-O covert timing channels. Moreover, the method exhibits strong robustness under conditions of network jitter interference.