1

Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting on) other messages that I do not observe. I do not need to know how Z takes its actions, just that if sometimes it listens and acts on the messages received from Y or not.

For example say that Y can send either a 1 or a 0. Z can do one of four things say a,b,c,d. I can observe, the messages sent by Y and the actions taken by Z. But I have no information about what else is being sent to Z which effects the action of Z.

To my mind this has some similarities to steganography detection. Is Y sending messages with hidden instructions to Z? Zs actions are a function of the messages and other unknown factors.

|improve this question
  • So, no interaction with the scenario; passive detection alone? – schroeder♦ Dec 4 '18 at 12:45
  • Is it a theoretical question, or do you have a real use-case in mind ? In the second case some existing software might help you, but we will need more information on you use-case (is it on windows or linux? does it uses the network, sockets or pipes? what is the communication protocol? etc.). – A. Hersean Dec 4 '18 at 12:51
  • It is mostly theoretical at the moment ... – user27815 Dec 4 '18 at 13:11
  • And yes passive detection .. – user27815 Dec 4 '18 at 13:12
1

You could run a statistical analysis.

If messages from Y and behaviour observed in Z are uncorrelated, then the frequency of behaviours by Z conditioned by message Y0, Y1, etc. will be the same.

You would also need to run correlations on time-delayed and message-delayed hypotheses, as well as multiple-message correlation, i.e. Z(Y(n), Y(n-1), Y(n-2)).

For example, the pair of messages ("SIMON SAYS", "(something)") and ("(whatever)", "(something)") will see, in the first case, a strong correlation on the second message, in the second, no correlation at all. Overall correlation on just (something) will be weak. Correlation on message pairs will be strong, leading to the conclusion that "SIMON SAYS" primes Y to obey the next message.

|improve this answer
  • Yes.. it's just that we have the confounding of other messages.. which we don't observe, so can not account for. – user27815 Dec 4 '18 at 13:13
  • Yes, but still you ought to observe some correlation. Granted, it all depends on how much data there is to go round, and what percentage of the actual message traffic non-Y sources are accountable for. – LSerni Dec 4 '18 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.