Elena E. Timonina

Prohibitions in discrete probabilistic statistical problems

Abstract In this paper, we continue our studies concerning consistent sequences of tests in discrete probabilistic statistical schemes. We introduce the concept of a ‘prohibition’ in a discrete probabilistic scheme and give a series of examples where ‘prohibitions’ arise. In statistical problems, tests exist whose critical sets are completely determined by means of ‘prohibitions.’ We find necessary and sufficient conditions for existence of consistent sequences of tests in discrete schemes where all critical sets are defined by means of ‘prohibitions.’

Problems of modeling in the analysis of covert channels

Sometimes the analysis of covert channel is weakly dependent on the correctness of probabilistic models, but more often the result of such analysis is seriously dependent on the choice of aprobabilistic model. We show how the problem of detection of covert communications depends on the correctness of the choice of probabilistic model. We found the dependence of judgments about invisibility of covert communication from the bans in a probabilistic model of the legal communication.

Detection of illegal information flow

Several types of statistical covert channels that break the informational system security policy ensuring a reliable information transfer between hostile agents can be detected by a competent warden. We introduce the basic detection technique and analyze the conditions under which the warden with limited resources can perform his task successfully.

Consistent Sequences of Tests Defined by Bans

Finite probability spaces are important in such problems of operation research as data mining, computer simulation, network and computer security, cryptography and many others. We consider complexity of testing a simple hypothesis H 0,n against complex alternative H 1, n in finite models. The way to make calculation of tests simpler is to build critical sets dependent on smallest bans (the shortest vectors, which have probability zero). We prove necessary and sufficient conditions when consistent sequence of statistical tests exists and all critical sets of the tests are defined by smallest bans. Existence of such sequences of tests is equivalent to existence of strictly consistent sequence of tests.

Statistical covert channels through PROXY server

The paper is devoted to creating a covert channel through a PROXY server. The channel is based upon data permutation in server buffer using the sequence of packets coming from the router connected to the PROXY server. The resulting data flow allows to create a statistical covert channel that transfers information by manipulating expectation and dispersion of the number of increasing pairs in the sequence of network addresses.

Statistical decision functions based on bans

A ban of a probability distribution on a finite space is a point which has zero probability. A statistical decision function defined by bans has zero probability for false alarms, low complexity of calculation and may be consistent. We prove properties of these decision functions and analyze the case for statistical search of bans. Then we apply these results to the problems of vulnerability search in computer programs and to the construction of covert channels.

Power Functions Of Statistical Criteria Defined By Bans.

The basic problem for developers of monitoring systems for technological processes is to exclude the false alarms. False alarms generate the interruption of technological process and lead to the manual analysis of the reasons of the wrong system behavior. In the paper it is offered to use the statistical techniques with probabilities of false alarms equal to zero. This class of statistical decisions is based on concept of bans of probability measures in a finite space. Conditions under which powers of statistical criteria accept value 1 on a finite step are found. These conditions are formulated in terms of supports of probability measures. INTRODUCTION The paper deals with the mathematical model of monitoring of a technological system behavior with finite set of states. Suppose that such monitoring systems solve the task with the help of statistical techniques. In the mathematical models the trajectories of functioning of such system are represented by infinite sequences in which each coordinate accepts value in the finite fixed alphabet. Application of statistical techniques on a set of infinite sequences demands a probability measure P which describes the correct behavior of analyzable system. The wrong system behavior is described by a probability distribution Q. Different wrong behaviors of the technological system can be described by different distributions of probabilities on space of the infinite sequences. However in the elementary case it is possible to assume that distribution of the wrong behavior of technological system is unique and known. In practice the monitoring system of technological process observes initial sections of trajectories and for each step n it tests the hypothesis H0, n that the distribution of the observed section of trajectory is defined by probablity distribution measure Pn which is the projection of measure P on the first n coordinates. The alternative hypothesis H1, n in the elementary case is defined by measure Qn which is projection of measure Q on the first n coordinates. Criteria of testing of hypotheses H0, n against alternatives H1, n allow to make the decision about the wrong behavior of technological system. The basic problem for developers of such monitoring systems is the false alarms appearance when the correct behavior of technological process is perceived as wrong (Axelson, 1999). False alarms generate interruption of technological process, and that the worst, they lead to necessity of the manual analysis of the reasons of the wrong system behavior. For this purpose in the paper it is offered to use the statistical techniques for monitoring with probabilities of false alarms equal to zero. This class of statistical decisions is based on concept of the ban (Grusho and Timonina, 2011; Grusho et al., 2013). The ban of a probability measure in the considered scheme is a vector for which probability of its appearance is equal to 0 in a finite projection of measure. Any statistical criterion for testing H0, n against H1, n is defined by a critical set Sn of vectors of length n. When the observed vector is in Sn then it leads to the acceptance of alternative H1, n. If all vectors in Sn are bans of a measure Pn, say that the criterion is defined by bans of a measure P . Existence and properties of the criteria determined by bans were researched in papers (Grusho and Timonina, 2011; Grusho et al., 2013, 2014). In particular, the behavior of power function of criteria was researched in case of n → ∞. Conditions of consistency of sequence of the statistical criteria determined by bans, i.e. conditions when powers of criteria tend to 1 in case of n→∞ are found. Specialists believed that all properties of power functions for finite n were defined by numerical values of probability distributions P and Q. However in this paper conditions under which power functions of criteria accept value 1 on a finite step are found. These conditions are formulated in terms of supports of probability measures for the main measure P on space of the infinite sequences and for alternatives. Information about supports of measures is known not always. Therefore in the paper we built the constructive check of conditions for existence of criteria with the power function equals to 1 on a finite step N . The article is structured as follows. Section 2 introduces definitions and previous results. In Section 3 the Proceedings 29th European Conference on Modelling and Simulation ©ECMS Valeri M. Mladenov, Petia Georgieva, Grisha Spasov, Galidiya Petrova (Editors) ISBN: 978-0-9932440-0-1 / ISBN: 978-0-9932440-1-8 (CD) main results are proved. In Conclusion we shortly analyze applications of constructed sequences of tests. MATHEMATICAL MODEL. BASIC DEFINITIONS AND PREVIOUS RESULTS Let’s consider mathematical model of some technological process. Let X = {x1, ..., xm} be a finite set, X be a Cartesian product of X, X∞ be a set of all sequences when i-th element belongs to X. Define A be a σ-algebra on X∞, generated by cylindrical sets. A is also Borel σ-algebra in Tychonoff product X∞, where X has a discrete topology (Bourbaki, 1968; Prokhorov and Rozanov, 1993). On (X∞, A) a probability measure P is defined. For any n = 1, 2, ..., assume that probability distribution Pn is a projection of measure P on the first n coordinates of random sequences from X∞. It is clear that for every Bn ⊆ X Pn(Bn) = P (Bn ×X∞). (1) LetDn(P ) be the support of a measure Pn (Prokhorov and Rozanov, 1993): Dn(P ) = {xn ∈ X, Pn(xn) > 0}. Define cylindrical set ∆n(P ) as follows: ∆n(P ) = Dn(P )×X∞. The sequence of cylindrical sets ∆n(P ), n=1,2,..., is not increasing and ∆(P ) = lim n→∞ ∆n(P ) = ∞ ⋂

Some relations between discrete statistical problems and properties of probability measures on topological spaces

We study problems of existence of consistent sequences of tests in a sequence of finite spaces. We also touch upon problems of existence of sequence of tests close in some sense to consistent ones. These problems are closely related to properties of some sets in Tikhonov products.

Covert channel invisibility theorem

We consider a sequence of finite products of a finite set. A statistical test problem is defined on every product. Consistent sequences of probability measures on these products of the set generate probability measures on the set of infinite sequences. Sufficient conditions of nonexistence for consistent test sequences are proved. These results may be interpreted from the point of view of covert channel secrecy.

Estimation of the time needed to set up a covert channel

In this study, we construct the mathematical model of a covert channel of agent interaction in the wide area network and in a closed segment of a local area network. The channel transmits information through an IPsec-based protective device with the use of encapsulation and enciphering of packets. We analyse the asymptotic behaviour of the time needed to learn the agent the language of information transmission. We prove that if the number n of nodes in an arbitrary segment and the number m of segments grow without limits, then the learning time is O(m2n ln n) under some conditions.