CTC datasets for ML algorithm testing: covert timing channels

Last updated:

Dec 2017


If your are using any of the material below please cite the corresponding publication:


CTC (Covert Timing Channels) datasets consist of a mix of preprocessed network traffic data with and without covert timing channels. from two sources: (a) real traffic captures from the MAWI project (overt flows), and (b) synthetic traffic generated with a testbed based on published techniques for the generation of covert timing channels (covert flows).

Flow vectors contain relevant statistical information provided in variations of the DAT-format (reduced to only one feature: IAT). The DAT-format was originally proposed in:

Iglesias, F., Annessi, R., and Zseby, T. (2016) DAT detectors: uncovering TCP/IP covert channels by descriptive analytics. Security Comm. Networks, 9: 3011–3029..

Datasets, experiments:

Example figures:

3D-scatter plot of the dataset (left) and detail (right). Blue dots correspond to flows with covert channels and red dots to flows without covert channels. In the left plot blue dots are superimposed for a better visualization. Figures correspond to the [ARES/CUING-2017 dataset].

3D-scatter plot Detailed 2D plot