prox0959/spectralcovertDetects network covert channels using Shannon entropy and Sarle's bimodality coefficient to flag encrypted ICMP/TCP payload exfiltration and timing-based leaks.
-brightgreen.svg){kind=icon}
Deterministic Cryptographic Network Covert Channel & Shannon Entropy Leak Detector
Developed by Çınar (@prox0959)
Academic Grade | Zero External Dependencies | Sub-Millisecond Analysis
Modern firewalls, deep packet inspection (DPI) engines, and data loss prevention (DLP) systems examine packet headers and search for cleartext patterns. Advanced Persistent Threats (APTs) and sophisticated malware evade these perimeters using Covert Channels (defined under DoD 5200.28-STD and academic information flow control):
0, $T_1$ for bit 1). The payload is 100% benign, but the rhythm leaks confidential data.SpectralCovert detects both vectors using pure mathematical statistics: Shannon Information Entropy, Sarle's Bimodality Coefficient, and Jitter Spectral Analysis with zero external dependencies.
Information entropy quantifies the degree of uncertainty or compressibility in a byte sequence:
$$H(X) = - \sum_{i=1}^{n} P(x_i) \log_2 P(x_i)$$
$$H_{norm} = \frac{H(X)}{\min(8.0, \log_2(N))}$$
When an adversary modulates bits $0$ and $1$ across inter-packet arrival times ($\Delta t_i = t_i - t_{i-1}$), natural network jitter converts the discrete delays into a bimodal Gaussian mixture distribution.
$$BC = \frac{\gamma^2 + 1}{\kappa}$$
Where:
socket, struct, math, statistics, argparse, time, random). No pip install required.abcdef..., Linux sequential).Runs a complete validation suite testing benign baselines vs encrypted ICMP storage exfiltration and modulated timing channels:
python spectralcovert.py --demo
Benchmark Output Preview:
========================================================================
ACADEMIC BENCHMARK: COVERT CHANNEL DETECTION VALIDATION
========================================================================
[PHASE 1] EVALUATING ICMP STORAGE CHANNELS (PAYLOAD SHANNON ENTROPY)
------------------------------------------------------------------------
[*] Test 1: Benign Windows ICMP Echo Request (32 bytes)
Payload: b'abcdefghijklmnopqrstuvwa'...
Entropy: [===========---------] 4.438 / 8.000 bits [NORMAL TEXT / OS PING]
Verdict: BENIGN (Score: 0/100)
[*] Test 2: Covert Exfiltration - Encrypted AES Stolen Key in ICMP Payload
Payload (hex): 6d379ecb7647003cb5e0b4554c7fb491...
Entropy: [===========---------] 4.750 / 8.000 bits [NORMAL TEXT / OS PING]
Verdict: ALERT_COVERT_EXFILTRATION (Score: 95/100)
-> Near-maximum entropy density (95.0% of theoretical limit, 4.750 bits/byte)
-> Abnormal byte diversity (87.5% unique symbols) - High confidence encrypted payload
[+] Phase 1 Passed: 100% Accuracy on Storage Exfiltration Channels.
[PHASE 2] EVALUATING COVERT TIMING CHANNELS (IPD & SPECTRAL ANALYSIS)
------------------------------------------------------------------------
[*] Generating benign traffic stream (100 packets, ~200ms interval + jitter)...
Sample Size: 99 intervals
Mean Delay: 199.554 ms | StdDev: 5.633 ms
Sarle's Bimodality Coefficient: 0.3486 (Threshold: 0.555)
Verdict: BENIGN_NATURAL_JITTER (Threat Score: 10/100)
[*] Generating Covert Timing Channel modulating: 'ETH2026'
Bit 0 delay -> 40ms, Bit 1 delay -> 140ms + simulated network jitter
Sarle's Bimodality Coefficient: 1.0282 (Threshold: 0.555)
Detected Dual Clusters: T0 ~ 38.4 ms | T1 ~ 112.3 ms
Verdict: COVERT_TIMING_CHANNEL_DETECTED (Threat Score: 92/100)
--- Bimodal Inter-Packet Delay Histogram ---
32.6 - 46.9 ms | ######################### (33)
46.9 - 61.2 ms | ## (3)
61.2 - 75.5 ms | (0)
75.5 - 89.7 ms | (0)
89.7 - 104.0 ms | (0)
104.0 - 118.3 ms | (0)
118.3 - 132.6 ms | (1)
132.6 - 146.9 ms | ############## (19)
[+] Covert Message Reconstruction Attempt:
Original Secret : 'ETH2026'
Decoded Payload : 'ETH2026'
Match Confirmed : True
[+] Phase 2 Passed: 100% Accuracy on Covert Timing Channel Detection.
Simulate data exfiltration using delay modulation and inspect the real-time bimodal distribution:
python spectralcovert.py --simulate-leak "CONFIDENTIAL_KEY"
Inspect arbitrary text or hex byte sequences for entropy anomalies:
python spectralcovert.py --analyze-text "sk-proj-938210384019283019283019283019283"
Covert channel detection is a premier research domain in computer systems security (e.g., Information Security Group at ETH Zurich, Network and System Security at TU Munich, and Oxford Cyber Security).
This project demonstrates mastery of:
SpectralCovert/
├── core/
│ ├── __init__.py # Package entry
│ ├── entropy.py # Shannon & normalized entropy, Chi-Squared test, OS baselines
│ ├── timing.py # IPD analyzer, Sarle's bimodality coefficient, secret bit recovery
│ ├── channel_sim.py # Synthetic benign & covert traffic generator
│ └── visualizer.py # ASCII spectral histogram & terminal formatting
├── tests/
│ └── test_covert.py # Automated unit test suite
├── spectralcovert.py # Main CLI & benchmark runner
├── README.md # Technical documentation & mathematics
├── LICENSE # MIT License
└── .gitignore
Released under the MIT License. Created by Çınar (@prox0959).
@software{spectralcovert2026,
author = {prox0959},
title = {SpectralCovert: Deterministic Network Covert Channel and Shannon Entropy Leak Detector},
year = {2026},
url = {https://github.com/prox0959/SpectralCovert}
}