Covert Channel Detection via Protocol Analysis in LAN Security

The patent applies the principle of detecting covert channels by monitoring changes in communication patterns and protocols, analogous to detecting color changes. The system identifies covert channels by observing deviations from normal communication behaviors, such as unusual protocol sequences, timing patterns, or data transfer characteristics that differ from legitimate communications.

The patent introduces an intermediary security device positioned between communicating parties that monitors and analyzes network traffic without blocking legitimate communication. This intermediary detects covert channels by examining communication patterns while allowing normal data transfer to continue, thus maintaining information transfer capability while improving detectability.

The patent applies partial action by implementing selective monitoring that focuses only on specific communication patterns, protocols, or time periods that are suspicious or relevant to covert channel detection. Instead of analyzing all network traffic in detail, the system applies targeted inspection to reduce processing overhead while maintaining effective security monitoring for potential threats.

The patent segments network traffic analysis into different layers or types, applying different monitoring intensities to different traffic categories. Legitimate high-volume traffic receives minimal inspection, while suspicious or unusual traffic patterns trigger more detailed analysis. This segmentation allows comprehensive security monitoring without uniformly degrading network performance across all traffic types.