{"id":"https://openalex.org/W7116678650","doi":"https://doi.org/10.23919/cnsm67658.2025.11297460","title":"TimeLSB: eBPF-based Covert Channel on TCP Timestamps","display_name":"TimeLSB: eBPF-based Covert Channel on TCP Timestamps","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116678650","doi":"https://doi.org/10.23919/cnsm67658.2025.11297460"},"language":null,"primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297460","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297460","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120970947","display_name":"Yusuf \u015eahin","orcid":null},"institutions":[{"id":"https://openalex.org/I1290270558","display_name":"Goodyear (United Kingdom)","ror":"https://ror.org/03tvt3c62","country_code":"GB","type":"company","lineage":["https://openalex.org/I1290270558","https://openalex.org/I4210143271"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Yusuf \u015eahin","raw_affiliation_strings":["METU,Dept. of Computer Eng.,Tϋrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"METU,Dept. of Computer Eng.,Tϋrkiye","institution_ids":["https://openalex.org/I1290270558"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030797492","display_name":"Ertan Onur","orcid":"https://orcid.org/0000-0003-0514-5578"},"institutions":[{"id":"https://openalex.org/I1290270558","display_name":"Goodyear (United Kingdom)","ror":"https://ror.org/03tvt3c62","country_code":"GB","type":"company","lineage":["https://openalex.org/I1290270558","https://openalex.org/I4210143271"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ertan Onur","raw_affiliation_strings":["METU,Dept. of Computer Eng.,Tϋrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"METU,Dept. of Computer Eng.,Tϋrkiye","institution_ids":["https://openalex.org/I1290270558"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5120999805","display_name":"Can Karacelebi","orcid":null},"institutions":[{"id":"https://openalex.org/I1290270558","display_name":"Goodyear (United Kingdom)","ror":"https://ror.org/03tvt3c62","country_code":"GB","type":"company","lineage":["https://openalex.org/I1290270558","https://openalex.org/I4210143271"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Can Karacelebi","raw_affiliation_strings":["METU,Dept. of Computer Eng.,Tϋrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"METU,Dept. of Computer Eng.,Tϋrkiye","institution_ids":["https://openalex.org/I1290270558"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I1290270558"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.59750179,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9789000153541565,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9789000153541565,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.0071000000461936,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.002899999963119626,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/covert-channel","display_name":"Covert channel","score":0.7113000154495239},{"id":"https://openalex.org/keywords/timestamp","display_name":"Timestamp","score":0.6166999936103821},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5853000283241272},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.5292999744415283},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.47450000047683716},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.44670000672340393},{"id":"https://openalex.org/keywords/zeta-tcp","display_name":"Zeta-TCP","score":0.39809998869895935},{"id":"https://openalex.org/keywords/ping","display_name":"Ping (video games)","score":0.37549999356269836},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.3589000105857849}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.715399980545044},{"id":"https://openalex.org/C29024540","wikidata":"https://www.wikidata.org/wiki/Q1476964","display_name":"Covert channel","level":5,"score":0.7113000154495239},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.6955000162124634},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.6166999936103821},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5853000283241272},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.5292999744415283},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.47450000047683716},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.44670000672340393},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.43130001425743103},{"id":"https://openalex.org/C30305156","wikidata":"https://www.wikidata.org/wiki/Q8069697","display_name":"Zeta-TCP","level":4,"score":0.39809998869895935},{"id":"https://openalex.org/C156308498","wikidata":"https://www.wikidata.org/wiki/Q1347898","display_name":"Ping (video games)","level":2,"score":0.37549999356269836},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3589000105857849},{"id":"https://openalex.org/C58861099","wikidata":"https://www.wikidata.org/wiki/Q548838","display_name":"Handshaking","level":2,"score":0.33889999985694885},{"id":"https://openalex.org/C2778067643","wikidata":"https://www.wikidata.org/wiki/Q166507","display_name":"Interval (graph theory)","level":2,"score":0.33809998631477356},{"id":"https://openalex.org/C190362163","wikidata":"https://www.wikidata.org/wiki/Q7669759","display_name":"TCP hole punching","level":5,"score":0.3303000032901764},{"id":"https://openalex.org/C65567647","wikidata":"https://www.wikidata.org/wiki/Q81414","display_name":"Internet protocol suite","level":3,"score":0.3287999927997589},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.32589998841285706},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.3149999976158142},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.30640000104904175},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C2780898871","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Performance metric","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C120837960","wikidata":"https://www.wikidata.org/wiki/Q7669763","display_name":"TCP tuning","level":4,"score":0.2581000030040741},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.251800000667572},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297460","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297460","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W1549081716","https://openalex.org/W1739088677","https://openalex.org/W2099137371","https://openalex.org/W2151185692","https://openalex.org/W2157428729","https://openalex.org/W3195497922","https://openalex.org/W4292071035","https://openalex.org/W4311721665","https://openalex.org/W4312286129","https://openalex.org/W4383820842","https://openalex.org/W4403981268","https://openalex.org/W4405935709","https://openalex.org/W4411866935"],"related_works":[],"abstract_inverted_index":{"This":[0],"paper":[1],"presents":[2],"TimeLSB,":[3],"a":[4,32,40,54,126],"covert":[5,63,130,142],"channel":[6,19,52,143],"built":[7],"on":[8,80],"TCP":[9,73],"timestamps":[10],"using":[11,109],"extended":[12],"Berkeley":[13],"Packet":[14],"Filter":[15],"(eBPF)":[16],"technology.":[17],"The":[18,75],"encodes":[20],"information":[21],"by":[22],"modifying":[23],"the":[24,36,44,69,110,122,137],"least":[25],"significant":[26],"bit":[27],"of":[28,56,71,84,139],"timestamp":[29],"values":[30,117],"through":[31],"CRC32-based":[33],"scheme":[34],"in":[35],"Linux":[37],"kernel,":[38],"while":[39,115],"passive":[41],"receiver":[42],"reconstructs":[43],"hidden":[45],"message.":[46],"We":[47],"implement":[48],"and":[49,97,131,144],"evaluate":[50],"this":[51],"under":[53],"range":[55],"controlled":[57],"network":[58,149],"impairments,":[59],"demonstrating":[60],"that":[61,114],"embedding":[62],"bits":[64],"does":[65],"not":[66],"significantly":[67],"alter":[68],"behavior":[70],"normal":[72,132],"connections.":[74],"eBPF":[76],"implementation":[77],"introduces":[78],"only":[79],"average":[81],"250":[82],"ns":[83],"processing":[85],"overhead":[86],"per":[87,95],"packet,":[88],"which":[89],"corresponds":[90],"to":[91,101],"several":[92],"million":[93],"packets":[94],"second":[96],"is":[98],"negligible":[99],"compared":[100],"typical":[102],"forwarding":[103],"performance.":[104],"Finally,":[105],"we":[106],"analyze":[107],"detectability":[108],"distinct-timestamp":[111],"ratio,":[112],"showing":[113],"absolute":[116],"differ":[118],"from":[119],"prior":[120],"work,":[121],"metric":[123],"still":[124],"provides":[125],"stable":[127],"separation":[128],"between":[129],"flows.":[133],"These":[134],"results":[135],"highlight":[136],"practicality":[138],"an":[140],"eBPFbased":[141],"provide":[145],"defensive":[146],"insights":[147],"for":[148],"security":[150],"operations.":[151]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-12-22T00:00:00"}