With the rapid growth of data exfiltration carried out by cyber attacks, Covert Timing Channels (CTC) have become an imminent network security risk that continues to grow in both sophistication and utilization. These types of channels utilize inter-arrival times to steal sensitive data from the targeted networks. CTC detection relies increasingly on machine learning techniques, which utilize statistical-based metrics to separate malicious (covert) traffic flows from the legitimate (overt) ones. However, given the efforts of cyber attacks to evade detection and the growing column of CTC, covert channels detection needs to improve in both performance and precision to detect and prevent CTCs and mitigate the reduction of the quality of service caused by the detection process. In this article, we present an innovative image-based solution for fully automated CTC detection and localization. Our approach is based on the observation that the covert channels generate traffic that can be converted to colored images. Leveraging this observation, our solution is designed to automatically detect and locate the malicious part (i.e., set of packets) within a traffic flow. By locating the covert parts within traffic flows, our approach reduces the drop of the quality of service caused by blocking the entire traffic flows in which covert channels are detected. We first convert traffic flows into colored images, and then we extract image-based features for detection covert traffic. We train a classifier using these features on a large data set of covert and overt traffic. This approach demonstrates a remarkable performance achieving a detection accuracy of 95.83% for cautious CTCs and a covert traffic accuracy of 97.83% for 8 bit covert messages, which is way beyond what the popular statistical-based solutions can achieve.

Covert timing channels are an important alternative for transmitting information in the world of the Internet of Things (IoT). In covert timing channels data are encoded in inter-arrival times between consecutive packets based on modifying the transmission time of legitimate traffic. Typically, the modification of time takes place by delaying the transmitted packets on the sender side. A key aspect in covert timing channels is to find the threshold of packet delay that can accurately distinguish covert traffic from legitimate traffic. Based on that we can assess the level of dangerous of security threats or the quality of transferred sensitive information secretly. In this paper, we study the inter-arrival time behavior of covert timing channels in two different network configurations based on statistical metrics, in addition we investigate the packet delaying threshold value. Our experiments show that the threshold is approximately equal to or greater than double the mean of legitimate inter-arrival times. In this case covert timing channels become detectable as strong anomalies.

In the era of digital healthcare, biomedical data sharing is of paramount importance for the advancement of research and personalised healthcare. However, sharing such data while preserving user privacy and ensuring data security poses significant challenges. This paper introduces BioChainReward (BCR), a blockchain-based framework designed to address these concerns. BCR offers enhanced security, privacy, and incentivisation for data sharing in biomedical applications. Its architecture consists of four distinct layers: data, blockchain, smart contract, and application. The data layer handles the encryption and decryption of data, while the blockchain layer manages data hashing and retrieval. The smart contract layer includes an AI-enabled privacy-preservation sublayer that dynamically selects an appropriate privacy technique, tailored to the nature and purpose of each data request. This layer also features a feedback and incentive mechanism that incentivises patients to share their data by offering rewards. Lastly, the application layer serves as an interface for diverse applications, such as AI-enabled apps and data analysis tools, to access and utilise the shared data. Hence, BCR presents a robust, comprehensive approach to secure, privacy-aware, and incentivised data sharing in the biomedical domain.