Pattern-Based Survey and Categorization of Network Covert Channel Techniques
---
paper_title: Optimization of covert channel identification

paper_content:

We characterize the properties of covert channels and present a taxonomy of covert channels. Information flow sequence is adopted to represent information flows and covert channels. Covert channels are categorized according to their information flow characteristics. On this basis, we explore the optimization of covert channel identification with the shared resource matrix method adopted for demonstration. A general framework for covert channel identification founded on information flow analysis is proposed. We also review previous work within our framework. The application of our approach to a practical system is shown. At last, a new class of covert channels which used to be omitted by previous work is introduced
---
paper_title: The Silence of the LANs: Efficient Leakage Resilience for IPsec VPNs

paper_content:

Virtual Private Networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglect the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals were made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties.
---
paper_title: Detecting covert timing channels: an entropy-based approach

paper_content:

The detection of covert timing channels is of increasing interest in light of recent practice on the exploitation of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. The existing detection schemes are ineffective to detect most of the covert timing channels known to the security community. In this paper, we introduce a new entropy-based approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropy-based approach is sensitive to the current covert timing channels, and is capable of detecting them in an accurate manner.
---
paper_title: Covert Channels - A Context-Based View

paper_content:

In this paper we introduce a taxonomy of covert channels that is based on the context in which the covert channel occurs. This differs from the usual taxonomies, which are based upon the mechanisms employed by the covert channel. Our goal is to use a context-based taxonomy to aid in the understanding of the tradeoffs that are involved in building a secure system.
---
paper_title: Entropy based taxonomy of network convert channels

paper_content:

In this paper, we examine general mechanisms that a network covert channel may exploit, and we characterize the essence of network covert channels, which are decided by overt sources. So we present a taxonomy of network covert channels based on entropy of overt sources. We classify overt sources into three categories, as variety entropy, constrant entropy and fixed entropy sources, and name the network covert channels correspondingly. For each category we give the definition, meaning, and countermeasure method. Then we group classical network covert channels emerged in 30 years and representational network covert channels proposed in recent 3 years into our taxonomy framework.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Formal pattern specifications to facilitate semi-automated user interface generation

paper_content:

This paper depicts potentialities of formal HCI pattern specifications with regard to facilitate the semi-automated generation of user interfaces for interactive applications. In a first step existing proven and well accepted techniques in the field of model-based user interface development are highlighted and briefly reviewed. Subsequently it is discussed how we combine model-based and pattern-oriented methods within our user interface modeling and development framework in order to partly enable automated user interface generation. In this context a concrete pattern definition approach is introduced and illustrated with tangible examples from the domain of interactive knowledge sharing applications.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert Channels in Internet Protocols: A Survey

paper_content:

The creation of covert channels in public computer networks can prove an effective means of information hiding and secret communication. With the widespread adoption of the Internet the TCP/IP suite of protocols have become pervasive, and therefore an attractive target for covert channel exploitation. This paper gives a brief overview of covert channels in communication networks, and presents a brief survey of some recent and relevant papers on the use of covert channels in the common Internet protocols.
---
paper_title: Perspectives on HCI patterns: concepts and tools

paper_content:

This workshop will explore a diversity of perspectives on Patterns and Patterns Languages for HCI as well as the requirements for software tools needed to improve the effectiveness of both pattern creation and pattern use. Through discussion of conceptual and methodological issues of why (and how) patterns are identified and in what circumstances they are useful in the design process we hope to map out the conceptual landscape of HCI patterns. By moving closer and examining pattern-related behavior and experiences we hope to identify the requirements for tools to make progress through that landscape.
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: On Public-Key Steganography in the Presence of an Active Warden

paper_content:

The so-called prisoners’ problem, in which two individuals attempt to communicate covertly without alerting a “warden” who controls the communications channel, has taken a number of forms, adorned with various assumptions or requirements which make the problem more or less difficult. One assumption which makes the problem considerably more managable is that the participants are allowed to share some secret information (such as an encryption key) prior to imprisonment. Another assumption, which makes the problem much more difficult, is that the warden be allowed to modify messages sent between the prisoners as well as read them. This paper describes techniques for pure steganography, in which no secret information needs to be shared before imprisonment. First, a modification of an existing protocol will be shown to admit pure steganography if the warden is not allowed to modify the contents of the channel. Then, a technique will be described that allows pure steganography between two prisoners in the presence in the presence of an active (content-modifying) warden.
---
paper_title: Covert Channels in LAN Protocols

paper_content:

Encryption is generally understood as being the basic mechanisms for LAN security. However, usage of encryption finds its limitations in case of an unauthorized information flow via covert channels. Some covert storage and timing channels inherent in a LAN's architecture are already described in the literature. This paper takes a more general approach. It shows, that there is a potential of unused bandwidth in commonly used LAN protocols (IEEE 802.2, 802.3, 802.4, 802.5), which might be exploitable as covert channel. The key point is, that exploitation of this potential of unused bandwidth is not a question of a LAN's architecture, but is strongly dependent on the design of its internal interfaces and on its implementations.
---
paper_title: Network Covert Channels: Design, Analysis, Detection, and Elimination

paper_content:

Indirect communication channels have been effectively employed in the communications world to bypass mechanisms that do not permit direct communication between unauthorized parties. Such covert channels emerge as a threat to information-sensitive systems in which leakage to unauthorized parties may be unacceptable (e.g., military systems). In this dissertation, we show that traffic analysis can counter traditional event-based covert channels, which do not employ any additional scheme to obfuscate the channel further. For these channels, we introduce effective noiseless and noisy covert channel detection mechanisms that capture the anomalous traffic patterns. However, because a motivated user can potentially hide the channel further, we introduce a new family of covert channels that do not produce such anomaly. These IP time-replay covert channels transmit covert messages by adjusting packet timings consistent with inter-arrival time sequences that are extracts from recently recorded normal sequences. Under certain assumptions and lowered data rates, these channels generate output sequences that are equal in distribution to normal sequences allowing them to by-pass traffic anomaly detection schemes that are based on distribution analysis. Additionally, we illustrate that these channels can potentially survive channel elimination schemes such as jammers and network data pumps with lowered data rates. Thus, we discuss two types of transformations on packet inter-arrival times to increase the efficacy of existing elimination schemes.
---
paper_title: The Prisoners’ Problem and the Subliminal Channel

paper_content:

Two accomplices in a crime have been arrested and are about to be locked in widely separated cells. Their only means of communication after they are locked up will he by way of messages conveyed for them by trustees -- who are known to be agents of the warden. The warden is willing to allow the prisoners to exchange messages in the hope that he can deceive at least one of them into accepting as a genuine communication from the other either a fraudulent message created by the warden himself or else a modification by him of a genuine message. However, since he has every reason to suspect that the prisoners want to coordinate an escape plan, the warden will only permit the exchanges to occur if the information contained in the messages is completely open to him -- and presumably innocuous. The prisoners, on the other hand, are willing to accept these conditions, i.e., to accept some risk of deception in order to be able to communicate at all, since they need to coordinate their plans. To do this they will have to deceive the warden by finding a way of communicating secretly in the exchanges, i.e., of establishing a “subliminal channel” between them in full view of the warden, even though the messages themselves contain no secret (to the warden) information‡. Since they anticipate that the warden will try to deceive them by introducing fraudulent messages, they will only exchange messages if they are permitted to authenticate them.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Detection of Covert Channel Encoding in Network Packet Delays

paper_content:

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.
---
paper_title: Keyboards and covert channels

paper_content:

This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host's network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.
---
paper_title: Covert Channel Elimination Protocols

paper_content:

With the increasing growth of electronic communications, it is becoming important to provide a mechanism for enforcing various security policies on network communications. This paper discusses our implementation of several previously proposed protocols that enforce theell LaPadula security model. We also introduce a new protocol called "Quantized Pump" that offers several advantages, and present experimental results to support our claims.
---
paper_title: 20 years of covert channel modeling and analysis

paper_content:

Covert channels emerged in mystery and departed in confusion. Covert channels are a means of communication between two processes that are not permitted to communicate, but do so anyway, a few bits at a time, by affecting shared resources. Information hiding is slightly different: the two communicating parties are allowed to talk, but the content is censored and restricted to certain subjects. The trick is to "piggyback" some contraband data invisibly on the legitimate content. The canonical example of this is to use the low-order two bits of each pixel in a picture for your secret message, since no one would notice if they were changed. When a similar idea was applied to smuggle information in network headers, we called it a network covert channel, mostly because the term "information hiding" hadn't been invented yet. The article traces the history of covert channel modeling from 1980 to the present (1999).
---
paper_title: Optimization of covert channel identification

paper_content:

We characterize the properties of covert channels and present a taxonomy of covert channels. Information flow sequence is adopted to represent information flows and covert channels. Covert channels are categorized according to their information flow characteristics. On this basis, we explore the optimization of covert channel identification with the shared resource matrix method adopted for demonstration. A general framework for covert channel identification founded on information flow analysis is proposed. We also review previous work within our framework. The application of our approach to a practical system is shown. At last, a new class of covert channels which used to be omitted by previous work is introduced
---
paper_title: Covert Channels - A Context-Based View

paper_content:

In this paper we introduce a taxonomy of covert channels that is based on the context in which the covert channel occurs. This differs from the usual taxonomies, which are based upon the mechanisms employed by the covert channel. Our goal is to use a context-based taxonomy to aid in the understanding of the tradeoffs that are involved in building a secure system.
---
paper_title: Entropy based taxonomy of network convert channels

paper_content:

In this paper, we examine general mechanisms that a network covert channel may exploit, and we characterize the essence of network covert channels, which are decided by overt sources. So we present a taxonomy of network covert channels based on entropy of overt sources. We classify overt sources into three categories, as variety entropy, constrant entropy and fixed entropy sources, and name the network covert channels correspondingly. For each category we give the definition, meaning, and countermeasure method. Then we group classical network covert channels emerged in 30 years and representational network covert channels proposed in recent 3 years into our taxonomy framework.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Covert Channels in Internet Protocols: A Survey

paper_content:

The creation of covert channels in public computer networks can prove an effective means of information hiding and secret communication. With the widespread adoption of the Internet the TCP/IP suite of protocols have become pervasive, and therefore an attractive target for covert channel exploitation. This paper gives a brief overview of covert channels in communication networks, and presents a brief survey of some recent and relevant papers on the use of covert channels in the common Internet protocols.
---
paper_title: The evolution of design patterns in HCI: from pattern languages to pattern-oriented design

paper_content:

User interface design patterns also called HCI or interaction or usability patterns have been introduced first as a medium to capture and represent solutions to users' problems. Patterns have been used also as a medium for transferring the expertise of HCI designers and usability professionals to software engineers, who are usually unfamiliar with UI design and usability principles. Design patterns have been considered also as a lingua franca for crossing cultural and professional barriers between different stakeholders. Several HCI professionals have introduced their own pattern languages with specific terminology, classification and meanings. Patterns have also been presented as building reusable blocks at different levels of granularity, which can be combined to compose new interactive systems. Despite the obvious and acclaimed potential of these pattern-driven design approaches, patterns usage has not achieved the acceptance and widespread applicability envisaged by pattern pioneers such as Christopher Alexander. This paper provides an analysis of the facts about patterns usages, pattern languages and pattern-based design approaches. Some shortcomings in the presentation and application of HCI patterns are identified and discussed under the prevailing fallacies. Based on the analysis of how patterns have used so far, we draw some recommendations and future perspectives on what can be done to address the existing shortcomings. Making patterns more accessible, easily understandable, comparable and integratable in software and HCI design tools can promote HCI patterns to claim the usability, usefulness and importance originally envisaged for the pattern-oriented design approach.
---
paper_title: Architectural Patterns for Enabling Application Security

paper_content:

Making an application secure is much harder than just adding a password protected login screen. This paper contains a collection of patterns to be used when dealing with application security. Secure Access Layer provides an interface for applications to use the security of the systems on which they are built. Single Access Point limits entry into the application through one single point. Check Point gives the developer a way to handle an unknown or changing security policy. Groups of users have different Roles that define what they can and cannot do. The global information about the user is distributed throughout the application with a Session. Finally, users are presented with either a Limited View of legal options or are given a Full View With Errors. These seven patterns work together to provide a security framework for building applications.
---
paper_title: Modeling patterns for task models

paper_content:

Models allow us to describe complex systems at different abstract and conceptual levels, hence amplify our analytical and problem solving capabilities, However, a lot of human effort and experience is needed to build correct models, and to translate them to concrete artifacts: in our case a usable user interface. This paper introduces the concept of task and pattern models to leverage the process of task modeling, and show how it can help build generic task models, link them, and instantiate them more readily. Once seen as patterns, we will demonstrate that task models can be disseminated and reused more easily by representing them as predefined types.
---
paper_title: A Pattern Language: Towns, Buildings, Construction

paper_content:

You can use this book to design a house for yourself with your family; you can use it to work with your neighbors to improve your town and neighborhood; you can use it to design an office, or a workshop, or a public building. And you can use it to guide you in the actual process of construction. After a ten-year silence, Christopher Alexander and his colleagues at the Center for Environmental Structure are now publishing a major statement in the form of three books which will, in their words, "lay the basis for an entirely new approach to architecture, building and planning, which will we hope replace existing ideas and practices entirely." The three books are The Timeless Way of Building, The Oregon Experiment, and this book, A Pattern Language. At the core of these books is the idea that people should design for themselves their own houses, streets, and communities. This idea may be radical (it implies a radical transformation of the architectural profession) but it comes simply from the observation that most of the wonderful places of the world were not made by architects but by the people. At the core of the books, too, is the point that in designing their environments people always rely on certain "languages," which, like the languages we speak, allow them to articulate and communicate an infinite variety of designs within a forma system which gives them coherence. This book provides a language of this kind. It will enable a person to make a design for almost any kind of building, or any part of the built environment. "Patterns," the units of this language, are answers to design problems (How high should a window sill be? How many stories should a building have? How much space in a neighborhood should be devoted to grass and trees?). More than 250 of the patterns in this pattern language are given: each consists of a problem statement, a discussion of the problem with an illustration, and a solution. As the authors say in their introduction, many of the patterns are archetypal, so deeply rooted in the nature of things that it seemly likely that they will be a part of human nature, and human action, as much in five hundred years as they are today.
---
paper_title: Perspectives on HCI patterns: concepts and tools

paper_content:

This workshop will explore a diversity of perspectives on Patterns and Patterns Languages for HCI as well as the requirements for software tools needed to improve the effectiveness of both pattern creation and pattern use. Through discussion of conceptual and methodological issues of why (and how) patterns are identified and in what circumstances they are useful in the design process we hope to map out the conceptual landscape of HCI patterns. By moving closer and examining pattern-related behavior and experiences we hope to identify the requirements for tools to make progress through that landscape.
---
paper_title: The evolution of design patterns in HCI: from pattern languages to pattern-oriented design

paper_content:

User interface design patterns also called HCI or interaction or usability patterns have been introduced first as a medium to capture and represent solutions to users' problems. Patterns have been used also as a medium for transferring the expertise of HCI designers and usability professionals to software engineers, who are usually unfamiliar with UI design and usability principles. Design patterns have been considered also as a lingua franca for crossing cultural and professional barriers between different stakeholders. Several HCI professionals have introduced their own pattern languages with specific terminology, classification and meanings. Patterns have also been presented as building reusable blocks at different levels of granularity, which can be combined to compose new interactive systems. Despite the obvious and acclaimed potential of these pattern-driven design approaches, patterns usage has not achieved the acceptance and widespread applicability envisaged by pattern pioneers such as Christopher Alexander. This paper provides an analysis of the facts about patterns usages, pattern languages and pattern-based design approaches. Some shortcomings in the presentation and application of HCI patterns are identified and discussed under the prevailing fallacies. Based on the analysis of how patterns have used so far, we draw some recommendations and future perspectives on what can be done to address the existing shortcomings. Making patterns more accessible, easily understandable, comparable and integratable in software and HCI design tools can promote HCI patterns to claim the usability, usefulness and importance originally envisaged for the pattern-oriented design approach.
---
paper_title: A Pattern Language: Towns, Buildings, Construction

paper_content:

You can use this book to design a house for yourself with your family; you can use it to work with your neighbors to improve your town and neighborhood; you can use it to design an office, or a workshop, or a public building. And you can use it to guide you in the actual process of construction. After a ten-year silence, Christopher Alexander and his colleagues at the Center for Environmental Structure are now publishing a major statement in the form of three books which will, in their words, "lay the basis for an entirely new approach to architecture, building and planning, which will we hope replace existing ideas and practices entirely." The three books are The Timeless Way of Building, The Oregon Experiment, and this book, A Pattern Language. At the core of these books is the idea that people should design for themselves their own houses, streets, and communities. This idea may be radical (it implies a radical transformation of the architectural profession) but it comes simply from the observation that most of the wonderful places of the world were not made by architects but by the people. At the core of the books, too, is the point that in designing their environments people always rely on certain "languages," which, like the languages we speak, allow them to articulate and communicate an infinite variety of designs within a forma system which gives them coherence. This book provides a language of this kind. It will enable a person to make a design for almost any kind of building, or any part of the built environment. "Patterns," the units of this language, are answers to design problems (How high should a window sill be? How many stories should a building have? How much space in a neighborhood should be devoted to grass and trees?). More than 250 of the patterns in this pattern language are given: each consists of a problem statement, a discussion of the problem with an illustration, and a solution. As the authors say in their introduction, many of the patterns are archetypal, so deeply rooted in the nature of things that it seemly likely that they will be a part of human nature, and human action, as much in five hundred years as they are today.
---
paper_title: Perspectives on HCI patterns: concepts and tools

paper_content:

This workshop will explore a diversity of perspectives on Patterns and Patterns Languages for HCI as well as the requirements for software tools needed to improve the effectiveness of both pattern creation and pattern use. Through discussion of conceptual and methodological issues of why (and how) patterns are identified and in what circumstances they are useful in the design process we hope to map out the conceptual landscape of HCI patterns. By moving closer and examining pattern-related behavior and experiences we hope to identify the requirements for tools to make progress through that landscape.
---
paper_title: Entropy based taxonomy of network convert channels

paper_content:

In this paper, we examine general mechanisms that a network covert channel may exploit, and we characterize the essence of network covert channels, which are decided by overt sources. So we present a taxonomy of network covert channels based on entropy of overt sources. We classify overt sources into three categories, as variety entropy, constrant entropy and fixed entropy sources, and name the network covert channels correspondingly. For each category we give the definition, meaning, and countermeasure method. Then we group classical network covert channels emerged in 30 years and representational network covert channels proposed in recent 3 years into our taxonomy framework.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Covert Channels in Internet Protocols: A Survey

paper_content:

The creation of covert channels in public computer networks can prove an effective means of information hiding and secret communication. With the widespread adoption of the Internet the TCP/IP suite of protocols have become pervasive, and therefore an attractive target for covert channel exploitation. This paper gives a brief overview of covert channels in communication networks, and presents a brief survey of some recent and relevant papers on the use of covert channels in the common Internet protocols.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: The Silence of the LANs: Efficient Leakage Resilience for IPsec VPNs

paper_content:

Virtual Private Networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglect the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals were made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties.
---
paper_title: Syntax and Semantics-Preserving Application-Layer Protocol Steganography

paper_content:

Protocol steganography allows users who wish to communicate secretly to embed information within other messages and network control protocols used by common applications. This form of unobservable communication can be used as means to enhance privacy and anonymity as well as for many other purposes, ranging from entertainment to protected business communication or national defense. In this paper, we describe our approach to application-layer protocol steganography, describing how we can embed messages into a commonly used TCP/IP protocol. We also introduce the notions of syntax and semantics preservation, which ensure that messages after embedding still conform to the host protocol. Based on those concepts, we attempt to produce reasonably secure and robust stegosystems. To demonstrate the efficacy of our approach, we have implemented protocol steganography within the Secure Shell (SSH) protocol. Findings indicate that protocol steganographic system is reasonably secure if the statistical profile of the covermessages and the statistical profile of its traffic match their counterparts after embedding.
---
paper_title: WLAN steganography: a first practical review

paper_content:

Two different approaches for constructing a steganographic channel in an IEEE 802.11 (WLAN) network are introduced in this paper. First test results on the reliability, undetectability and capacity of a prototypical implementation of both approaches are described and discussed.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: The Silence of the LANs: Efficient Leakage Resilience for IPsec VPNs

paper_content:

Virtual Private Networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglect the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals were made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties.
---
paper_title: Covert channel for local area network

paper_content:

There exist many TCP/IP covert channels in WAN for network hidden communication in last decades. However, there are few covert channels designed for the LAN while existing WAN covert channels could not be adapted for the LAN applications. In this paper we proposed a novel covert channel based on ARP broadcasting packets for LAN. In our method we employed the normal ARP request packets as the carrier which could escape feature-based detections. In addition, our method would not lead to abnormal network traffic. Experimental results show that our covert channel has great resistance to not only the feature-based detections but also the network traffic detections.
---
paper_title: Covert Channels in the IP Time To Live Field

paper_content:

Covert channels are used for the secret transfer of information. Unlike encryption, which only protects the information from unauthorised observers, covert channels aim to hide the very existence of the communication. The huge amount of data and vast number of different network protocol s in the Internet makes it an ideal high-capacity vehicle for covert communication. Covert channels pose a serious security threat as they can be used for a number of malicious activities. In this paper we present a novel covert channel inside the IP header’s Time To Live (TTL) field. The sender manipulates the TTLs of subsequent packets transmitting covert information to the receiver. Since network elements along the path also modify the TTL, the capacity and stealth of this channel depend on the “natural” TTL variation. We analyse this variation in multiple traffic traces and propose an encoding scheme, which makes the TTL covert channel look similar to “natural” variation. We also discuss methods to eliminate and detect this covert channel
---
paper_title: Detecting protocol switching covert channels

paper_content:

Network covert channels enable hidden communication and can be used to break security policies. Within the last years, new techniques for such covert channels arose, including protocol switching covert channels (PSCCs). PSCCs transfer hidden information by sending network packets with different selected network protocols. In this paper we present the first detection methods for PSCCs. We show that the number of packets between network protocol switches and the time between switches can be monitored to detect PSCCs with 98–99% accuracy for bit rates of 4 bits/second or higher.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Formal pattern specifications to facilitate semi-automated user interface generation

paper_content:

This paper depicts potentialities of formal HCI pattern specifications with regard to facilitate the semi-automated generation of user interfaces for interactive applications. In a first step existing proven and well accepted techniques in the field of model-based user interface development are highlighted and briefly reviewed. Subsequently it is discussed how we combine model-based and pattern-oriented methods within our user interface modeling and development framework in order to partly enable automated user interface generation. In this context a concrete pattern definition approach is introduced and illustrated with tangible examples from the domain of interactive knowledge sharing applications.
---
paper_title: Low-attention forwarding for mobile network covert channels

paper_content:

In a real-world network, different hosts involved in covert channel communication run different covert channel software as well as different versions of such software, i.e. these systems use different network protocols for a covert channel. A program that implements a network covert channel for mobile usage thus must be capable of utilizing multiple network protocols to deal with a number of different covert networks and hosts. We present calculation methods for utilizable header areas in network protocols, calculations for channel optimization, an algorithm to minimize a covert channel's overhead traffic, as well as implementationrelated solutions for such a mobile environment. By minimizing the channel's overhead depending on the set of supported protocols between mobile hosts, we also minimize the attention raised through the channel's traffic. We also show how existing covert network channel infrastructure can be modified without replacing all existing infrastructure elements by proposing the handling of backward-compatible software versions.
---
paper_title: Low-attention forwarding for mobile network covert channels

paper_content:

In a real-world network, different hosts involved in covert channel communication run different covert channel software as well as different versions of such software, i.e. these systems use different network protocols for a covert channel. A program that implements a network covert channel for mobile usage thus must be capable of utilizing multiple network protocols to deal with a number of different covert networks and hosts. We present calculation methods for utilizable header areas in network protocols, calculations for channel optimization, an algorithm to minimize a covert channel's overhead traffic, as well as implementationrelated solutions for such a mobile environment. By minimizing the channel's overhead depending on the set of supported protocols between mobile hosts, we also minimize the attention raised through the channel's traffic. We also show how existing covert network channel infrastructure can be modified without replacing all existing infrastructure elements by proposing the handling of backward-compatible software versions.
---
paper_title: Towards Adaptive Covert Communication System

paper_content:

Covert channels are secret communication paths, which existance is not expected in the original system design. Covert channels can be used as legimate tools of censorship resistance, anonimity and privacy preservation to address issues with "national" firewalls, citizen profiling and other "unethical" uses of information technology. Current steganographic methods that implement covert channels within network traffic, are highly dependent on particular media data or network protocol to hide data. In this paper we investigate the methods and an algorithm for implementing adaptive covert communication system that works on real-world Internet, capable of using multiple application-level protocols as its communication media and can be implemented as network application, therefore requires no system modifications of communicating nodes. The key difference from previous solutions is the use of adaptive redundant mechanism, which allows real-time underlying protocol switching and adaptation to the dynamic network configuration changes.
---
paper_title: Multi-Level Steganography: Improving Hidden Communication in Networks

paper_content:

The paper presents Multi-Level Steganography (MLS), which defines a new concept for hidden communication in telecommunication networks. In MLS, at least two steganographic methods are utilised simultaneously, in such a way that one method (called the upper-level) serves as a carrier for the second one (called the lower-level). Such a relationship between two (or more) information hiding solutions has several potential benefits. The most important is that the lower-level method steganographic bandwidth can be utilised to make the steganogram unreadable even after the detection of the upper-level method: e.g., it can carry a cryptographic key that deciphers the steganogram carried by the upper-level one. It can also be used to provide the steganogram with integrity. Another important benefit is that the lower-layer method may be used as a signalling channel in which to exchange information that affects the way that the upper-level method functions, thus possibly making the steganographic communication harder to detect. The prototype of MLS for IP networks was also developed, and the experimental results are included in this paper.
---
paper_title: Systematic engineering of control protocols for covert channels

paper_content:

Within the last years, new techniques for network covert channels arose, such as covert channel overlay networking, protocol switching covert channels, and adaptive covert channels. These techniques have in common that they rely on covert channel-internal control protocols (so called micro protocols) placed within the hidden bits of a covert channel's payload. An adaptable approach for the engineering of such micro protocols is not available. This paper introduces a protocol engineering technique for micro protocols. We present a two-layer system comprising six steps to create a micro protocol design. The approach tries to combine different goals: (1) simplicity, (2) ensuring a standard-conform behaviour of the underlying protocol if the micro protocol is used within a binary protocol header, as well as we provide an optimization technique to (3) raise as little attention as possible. We apply a context-free and regular grammar to analyze the micro protocol's behavior within the context of the underlying network protocol.
---
paper_title: Model-Based Covert Timing Channels: Automated Modeling and Evasion

paper_content:

The exploration of advanced covert timing channel design is important to understand and defend against covert timing channels. In this paper, we introduce a new class of covert timing channels, called model-based covert timing channels, which exploit the statistical properties of legitimate network traffic to evade detection in an effective manner. We design and implement an automated framework for building model-based covert timing channels. Our framework consists of four main components: filter, analyzer, encoder, and transmitter. The filter characterizes the features of legitimate network traffic, and the analyzer fits the observed traffic behavior to a model. Then, the encoder and transmitter use the model to generate covert traffic and blend with legitimate network traffic. The framework is lightweight, and the overhead induced by model fitting is negligible. To validate the effectiveness of the proposed framework, we conduct a series of experiments in LAN and WAN environments. The experimental results show that model-based covert timing channels provide a significant increase in detection resistance with only a minor loss in capacity.
---
paper_title: A Protocol for Building Secure and Reliable Covert Channel

paper_content:

This paper presents a secure and lightweight protocol for reliable data transfer through moderate bandwidth covert channels. Though data transfer through covert channels is not unprecedented, existing covert channels have been restricted to covert transmission of only small amounts of data. This paper demonstrates that it is possible to transmit large amounts of data covertly with sophisticated support such as security and reliability. The proposed protocol exploits ICMP echo request as covert medium, and uses OS finger-printing techniques to simulate real TCP/IP stack behavior for further security enhancements.
---
paper_title: Low-attention forwarding for mobile network covert channels

paper_content:

In a real-world network, different hosts involved in covert channel communication run different covert channel software as well as different versions of such software, i.e. these systems use different network protocols for a covert channel. A program that implements a network covert channel for mobile usage thus must be capable of utilizing multiple network protocols to deal with a number of different covert networks and hosts. We present calculation methods for utilizable header areas in network protocols, calculations for channel optimization, an algorithm to minimize a covert channel's overhead traffic, as well as implementationrelated solutions for such a mobile environment. By minimizing the channel's overhead depending on the set of supported protocols between mobile hosts, we also minimize the attention raised through the channel's traffic. We also show how existing covert network channel infrastructure can be modified without replacing all existing infrastructure elements by proposing the handling of backward-compatible software versions.
---
paper_title: Dynamic routing in covert channel overlays based on control protocols

paper_content:

Covert channels aim to carry information in a way prohibited by the security policy and can be used to bypass censorship (e.g. by journalists). To establish secure covert channel communications, overlay networks with internal control protocols can be built. We present a design method for control protocols within covert channels. Our protocol design provides the advantage of space-efficiency (in comparison to existing control protocols) and the advantage of dynamic extensibility. We apply the protocol design to realize OLSR-based dynamic routing for covert channel overlays. Our algorithm provides different optimization means to maximize the covertness and the connection quality of the channel. The approach is validated by an extensible prototype.
---
paper_title: Towards Adaptive Covert Communication System

paper_content:

Covert channels are secret communication paths, which existance is not expected in the original system design. Covert channels can be used as legimate tools of censorship resistance, anonimity and privacy preservation to address issues with "national" firewalls, citizen profiling and other "unethical" uses of information technology. Current steganographic methods that implement covert channels within network traffic, are highly dependent on particular media data or network protocol to hide data. In this paper we investigate the methods and an algorithm for implementing adaptive covert communication system that works on real-world Internet, capable of using multiple application-level protocols as its communication media and can be implemented as network application, therefore requires no system modifications of communicating nodes. The key difference from previous solutions is the use of adaptive redundant mechanism, which allows real-time underlying protocol switching and adaptation to the dynamic network configuration changes.
---
paper_title: Detecting covert timing channels: an entropy-based approach

paper_content:

The detection of covert timing channels is of increasing interest in light of recent practice on the exploitation of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. The existing detection schemes are ineffective to detect most of the covert timing channels known to the security community. In this paper, we introduce a new entropy-based approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropy-based approach is sensitive to the current covert timing channels, and is capable of detecting them in an accurate manner.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Reducing timing channels with fuzzy time

paper_content:

Fuzzy time is a collection of techniques that reduces the bandwidths of covert timing channels by making all clocks available to a process noisy. Developed in response to the problems posed by high-speed hardware timing channels, fuzzy time has been implemented in the VAX security kernel. Fuzzy time has proven to be highly effective against the timing channels in the VAX security kernel. Not only does fuzzy time close the high-speed channels, it does so at a much lower-than-anticipated performance cost. It is believed that the VAX security kernal managed to meet the covert channel guidelines while maintaining a good balance between security and performance. >
---
paper_title: A pump for rapid, reliable, secure communication

paper_content:

Communication from a low- to a high-level system without acknowledgements will be unreliable; with acknowledgements, it can be insecure. We propose to provide quantifiable security, acceptable reliability, and minimal performance penalties by interposing a device (called the Pump) to push messages to the high system and provide a controlled stream of acknowledgements to the low system. This paper describes how the Pump supports the transmission of messages upward and limits the capacity of the covert timing channel in the acknowledgement stream without affecting the average acknowledgement delay seen by the low system or the message delivery delay seen by the high system in the absence of actual Trojan horses. By adding random delays to the acknowledgment stream, we show how to further reduce the covert channel capacity even in the presence of cooperating Trojan horses in both the high and low systems. We also discuss engineering trade-offs relevant to practical use of the Pump.
---
paper_title: Covert flow trees: a technique for identifying and analyzing covert storage channels

paper_content:

A technique for detecting covert storage channels using a tree structure called a covert flow tree (CFT) is introduced. By traversing the paths of a CFT a comprehensive list of scenarios that potentially support covert communication via particular resource attributes can be automatically constructed. CFTs graphically illustrate the process through which information regarding the state of one attribute is relayed to another attribute, and how in turn that information is relayed to a listening process. Algorithms for automating the construction of CFT and potential covert channel operation sequences are presented. Two example systems are analyzed and their results are compared to two other analysis techniques performed on identical systems. The CFT approach not only identified all covert storage channels found by the other techniques, but discovered a channel not detected by the other techniques. >
---
paper_title: Shared resource matrix methodology: an approach to identifying storage and timing channels

paper_content:

Recognizing and dealing with storage and timing channels when performing the security analysis of a computer system is an elusive task. Methods for discovering and dealing with these channels have mostly been informal, and formal methods have been restricted to a particular specification language. A methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified is presented. The methodology is presented and applied to an example system having three different descriptions: English, formal specification, and high-order language implementation.
---
paper_title: Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics

paper_content:

A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. We discuss the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. We examine a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics. We discuss the key practical issues of "cold start" and attacks on the normalizer, and develop a methodology for systematically examining the ambiguities present in a protocol based on walking the protocol's header. We then present norm, a publicly available user-level implementation of a normalizer that can normalize a TCP traffic stream at 100,000 pkts/sec in memory-to-memory copies, suggesting that a kernel implementation using PC hardware could keep pace with a bidirectional 100 Mbps link with sufficient headroom to weather a high-speed flooding attack of small packets.
---
paper_title: Detecting covert timing channels: an entropy-based approach

paper_content:

The detection of covert timing channels is of increasing interest in light of recent practice on the exploitation of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. The existing detection schemes are ineffective to detect most of the covert timing channels known to the security community. In this paper, we introduce a new entropy-based approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropy-based approach is sensitive to the current covert timing channels, and is capable of detecting them in an accurate manner.
---
paper_title: Network Based Detection of Passive Covert Channels in TCP/IP

paper_content:

A new method of covert channel detection in initial sequence number (ISN) of TCP/IP is proposed in the paper. The detection is based on ISN generation model of original OS. Whenever any statistical deviations of ISN network packet from the ISN model are discovered; it is considered that this ISN packet is generated by malicious software, which tries to create a covert channel. The method was tested using experimental data generated by NUSHU covert channel creation tool, which has been developed by Joanna Rutkowska
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Detection of Covert Channel Encoding in Network Packet Delays

paper_content:

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Analyzing network-aware active wardens in IPv6

paper_content:

A crucial security practice is the elimination of network covert channels. Recent research in IPv6 discovered that there exist, at least, 22 different covert channels, suggesting the use of advanced active wardens as an appropriate countermeasure. The described covert channels are particularly harmful not only because of their potential to facilitate deployment of other attacks but also because of the increasing adoption of the protocol without a parallel deployment of corrective technology. We present a pioneer implementation of network-aware active wardens that eliminates the covert channels exploiting the Routing Header and the hop limit field as well as the well-known Short TTL Attack. Network-aware active wardens take advantage of network-topology information to detect and defeat covert protocol behavior. We show, by analyzing their performance over a controlled network environment, that the wardens eliminate a significant percentage of the covert channels and exploits with minimal impact over the end-to-end communications (approximately 3% increase in the packet roundtrip time).
---
paper_title: Detecting protocol switching covert channels

paper_content:

Network covert channels enable hidden communication and can be used to break security policies. Within the last years, new techniques for such covert channels arose, including protocol switching covert channels (PSCCs). PSCCs transfer hidden information by sending network packets with different selected network protocols. In this paper we present the first detection methods for PSCCs. We show that the number of packets between network protocol switches and the time between switches can be monitored to detect PSCCs with 98–99% accuracy for bit rates of 4 bits/second or higher.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert Channel Elimination Protocols

paper_content:

With the increasing growth of electronic communications, it is becoming important to provide a mechanism for enforcing various security policies on network communications. This paper discusses our implementation of several previously proposed protocols that enforce theell LaPadula security model. We also introduce a new protocol called "Quantized Pump" that offers several advantages, and present experimental results to support our claims.
---
paper_title: Stealthier inter-packet timing covert channels

paper_content:

Covert channels aimto hide the existence of communication. Recently proposed packet-timing channels encode covert data in inter-packet times, based on models of inter-packet times of normal traffic. These channels are detectable if normal inter-packet times are not independent identically-distributed, which we demonstrate is the case for several network applications. We show that ∼80% of channels are detected with a false positive rate of 0.5%. We then propose an improved channel that is much harder to detect. Only ∼9% of our new channels are detected at a false positive rate of 0.5%. Our new channel uses packet content for synchronisation and works with UDP and TCP traffic. The channel capacity reaches over hundred bits per second depending on overt traffic and network jitter.
---
paper_title: Covert Channels in Internet Protocols: A Survey

paper_content:

The creation of covert channels in public computer networks can prove an effective means of information hiding and secret communication. With the widespread adoption of the Internet the TCP/IP suite of protocols have become pervasive, and therefore an attractive target for covert channel exploitation. This paper gives a brief overview of covert channels in communication networks, and presents a brief survey of some recent and relevant papers on the use of covert channels in the common Internet protocols.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---

Title: Pattern-Based Survey and Categorization of Network Covert Channel Techniques

Section 1: INTRODUCTION
Description 1: Introduce network covert channels and the significance of creating a pattern-based taxonomy.

Section 2: COVERT CHANNEL FUNDAMENTALS AND RELATED WORK
Description 2: Provide background on network covert channels and discuss previous categorization efforts.

Section 3: Covert Channels
Description 3: Describe the history, adversary scenarios, channel noise considerations, and types of network covert channels.

Section 4: Related Work
Description 4: Summarize existing surveys and classification methods for network covert channels and explain the improvements offered by the pattern-based approach.

Section 5: PATTERN-RELATED FUNDAMENTALS AND THEIR TAXONOMY USE
Description 5: Introduce patterns and pattern languages, and describe the use of PLML for covert channel taxonomy.

Section 6: Patterns and Pattern Languages
Description 6: Provide a detailed overview of patterns, their properties, and the benefits of using pattern languages.

Section 7: Utilization of PLML for a Covert Channel-Based Taxonomy
Description 7: Explain how PLML can be utilized to create a standardized taxonomy of covert channel patterns.

Section 8: CLASSIFICATION OF COVERT CHANNEL PATTERNS BY USING PLML
Description 8: Present the classification of covert channel patterns, including the coverage of techniques and the evaluation process.

Section 9: Coverage of Techniques
Description 9: Explain the selection process for covert channel techniques included in the pattern catalog.

Section 10: Pattern List
Description 10: Provide a detailed description of the identified patterns and their attributes.

Section 11: EXTENSIBILITY OF THE PATTERN CATALOG
Description 11: Discuss how the pattern catalog can be extended and maintained through a collaborative effort.

Section 12: VARIATION OF COVERT CHANNEL PATTERNS
Description 12: Introduce the concept of pattern variation and explain how it adapts patterns to new contexts automatically.

Section 13: PLML-Based Pattern Variation
Description 13: Describe how PLML can facilitate the automatic adaptation of patterns to different network protocols.

Section 14: Requirements-Based Pattern Variation
Description 14: Explain how patterns can be adjusted to meet situational requirements, such as throughput and covertness.

Section 15: Similar Approaches to Pattern Variation
Description 15: Discuss approaches like pattern combination and pattern hopping that use multiple patterns simultaneously.

Section 16: COUNTERMEASURES
Description 16: Discuss protection techniques against network covert channels and evaluate their applicability to different patterns.

Section 17: Countermeasures for Patterns
Description 17: Evaluate existing countermeasures and their effectiveness against the identified covert channel patterns.

Section 18: CONCLUSION
Description 18: Summarize the findings, the significance of the pattern-based taxonomy, and propose future research directions.