Covert channel detection in VoIP streams

This paper presents two approaches to detect VoIP covert channel communications using compressed versions of the data packets. The approach is based on specialized random projection matrices that take advantage of prior knowledge about the normal traffic structure. The reduction scheme relies on the assumption that normal traffic packets belong to a subspace of smaller dimension or that can be included a convex set. We show that through the incorporation of this information in the design of the random projection matrices, the detection of anomalous traffic packets can be performed in the compressed domain with a slight performance loss with respect to the uncompressed domain. The validation of the detection algorithm is based on real data captured on a test bed designed to that end.