But I don't see how cover channels can even work as you describe them? Where does the constant flow originate in onion routing?
My idea is that the cover traffic channels would be the outermost layer for communication between nodes participating in the mix network. You perform routing and onion routing through these channels.
Why do you mention that? Even if you Sybil attacked the entry node, you wouldn't know what the destination packet looks like due to the onion routing.
Following the above, if an attacker controls all nodes to which you connect, the attacker can tell what part of the traffic is cover traffic.
If you find a way to switch around the order of layers, this can possibly be avoided. However, as you noted, doing cover traffic inside the onion routing network would be difficult.
My point is that 10-20% of the relay nodes Sybil attacked is not needle-in-the-haystack odds, more like the odds of flipping a dice or pair of them.
I see this point.