Principles and overview of network steganography
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Techniques for data hiding

paper_content:

Data hiding is the process of embedding data into image and audio signals. The process is constrained by the quantity of data, the need for invariance of the data under conditions where the `host' signal is subject to distortions, e.g., compression, and the degree to which the data must be immune to interception, modification, or removal. We explore both traditional and novel techniques for addressing the data hiding process and evaluate these techniques in light of three applications: copyright protecting, tamper-proofing, and augmentation data embedding.
---
paper_title: PadSteg: Introducing Inter-Protocol Steganography

paper_content:

Hiding information in network traffic may lead to leakage of confidential information. In this paper we introduce a new steganographic system: the PadSteg (Padding Steganography). To authors' best knowledge it is the first information hiding solution which represents inter-protocol steganography i.e. usage of relation between two or more protocols from the TCP/IP stack to enable secret communication. PadSteg utilizes ARP and TCP protocols together with an Etherleak vulnerability (improper Ethernet frame padding) to facilitate secret communication for hidden groups in LANs (Local Area Networks). Basing on real network traces we confirm that PadSteg is feasible in today's networks and we estimate what steganographic bandwidth is achievable while limiting the chance of disclosure. We also point at possible countermeasures against PadSteg.
---
paper_title: Deception on the Network: Thinking Differently About Covert Channels

paper_content:

The concept of covert channels has been visited frequently by academia in a quest to analyse their occurrence and prevention in trusted systems. This has lead to a wide variety of approaches being developed to prevent and identify such channels and implement applicable countermeasures. However, little of this research has actually trickled down into the field of operational security management and risk analysis. Quite recently a number of covert channels and enabling tools have appeared that did have a significant impact on the operational security of organizations. This paper identifies a number of those channels and shows the relative ease with which new ones can be devised. It identifies how risk management processes do not take this upcoming threat into account and suggests where improvements would be helpful.
---
paper_title: SkyDe: a Skype-based Steganographic Method

paper_content:

This paper introduces SkyDe (Skype Hide), a new steganographic method that utilizes Skype encrypted packets with silence to provide the means for clandestine communication. It is possible to reuse packets that do not carry voice signals for steganographic purposes because Skype does not use any silence suppression mechanism. The method’s proof-of-concept implementation and first experimental results are presented. They prove that the method is feasible and offers steganographic bandwidth as high as 2.8 kbps.
---
paper_title: Retransmission steganography and its detection

paper_content:

The paper presents a new steganographic method called RSTEG (retransmission steganography), which is intended for a broad class of protocols that utilises retransmission mechanisms. The main innovation of RSTEG is to not acknowledge a successfully received packet in order to intentionally invoke retransmission. The retransmitted packet carries a steganogram instead of user data in the payload field. RSTEG is presented in the broad context of network steganography, and the utilisation of RSTEG for TCP (transmission control protocol) retransmission mechanisms is described in detail. Simulation results are also presented with the main aim of measuring and comparing the steganographic bandwidth of the proposed method for different TCP retransmission mechanisms, as well as to determine the influence of RSTEG on the network retransmission level.
---
paper_title: Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds

paper_content:

Third-party cloud computing represents the promise of outsourcing as applied to computation. Services, such as Microsoft's Azure and Amazon's EC2, allow users to instantiate virtual machines (VMs) on demand and thus purchase precisely the capacity they require when they require it. In turn, the use of virtualization allows third-party cloud providers to maximize the utilization of their sunk capital costs by multiplexing many customer VMs across a shared physical infrastructure. However, in this paper, we show that this approach can also introduce new vulnerabilities. Using the Amazon EC2 service as a case study, we show that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target. We explore how such placement can then be used to mount cross-VM side-channel attacks to extract information from a target VM on the same machine.
---
paper_title: Covert Channels in SIP for VoIP signalling

paper_content:

In this paper, we evaluate available steganographic techniques for SIP (Session Initiation Protocol) that can be used for creating covert channels during signaling phase of VoIP (Voice over IP) call. Apart from characterizing existing steganographic methods we provide new insights by introducing new techniques. We also estimate amount of data that can be transferred in signalling messages for typical IP telephony call.
---
paper_title: Steganography in IEEE 802.11 OFDM symbols

paper_content:

This paper presents a new steganographic method called wireless padding WiPad. It is based on the insertion of hidden data into the padding of frames at the physical layer of wireless local area networks WLANs. A performance analysis based on a Markov model, previously introduced and validated by the authors, is provided for the method in relation to the IEEE 802.11 a/g standards. Its results prove that maximum steganographic bandwidth for WiPad is as high as 1.1Mbit/s for data frames and 0.44Mbit/s for acknowledgment frames. To the authors' best knowledge this is the most capacious of all the known steganographic network channels. Copyright © 2011 John Wiley & Sons, Ltd.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Techniques for data hiding

paper_content:

Data hiding is the process of embedding data into image and audio signals. The process is constrained by the quantity of data, the need for invariance of the data under conditions where the `host' signal is subject to distortions, e.g., compression, and the degree to which the data must be immune to interception, modification, or removal. We explore both traditional and novel techniques for addressing the data hiding process and evaluate these techniques in light of three applications: copyright protecting, tamper-proofing, and augmentation data embedding.
---
paper_title: Stegobot: a covert social network botnet

paper_content:

We propose Stegobot, a new generation botnet that communicates over probabilistically unobservable communication channels. It is designed to spread via social malware attacks and steal information from its victims. Unlike conventional botnets, Stegobot traffic does not introduce new communication endpoints between bots. Instead, it is based on a model of covert communication over a social-network overlay - bot to botmaster communication takes place along the edges of a social network. Further, bots use image steganography to hide the presence of communication within image sharing behavior of user interaction. We show that it is possible to design such a botnet even with a less than optimal routing mechanism such as restricted flooding. We analyzed a real-world dataset of image sharing between members of an online social network. Analysis of Stegobot's network throughput indicates that stealthy as it is, it is also functionally powerful - capable of channeling fair quantities of sensitive data from its victims to the botmaster at tens of megabytes every month.
---
paper_title: Deception on the Network: Thinking Differently About Covert Channels

paper_content:

The concept of covert channels has been visited frequently by academia in a quest to analyse their occurrence and prevention in trusted systems. This has lead to a wide variety of approaches being developed to prevent and identify such channels and implement applicable countermeasures. However, little of this research has actually trickled down into the field of operational security management and risk analysis. Quite recently a number of covert channels and enabling tools have appeared that did have a significant impact on the operational security of organizations. This paper identifies a number of those channels and shows the relative ease with which new ones can be devised. It identifies how risk management processes do not take this upcoming threat into account and suggests where improvements would be helpful.
---
paper_title: Retransmission steganography and its detection

paper_content:

The paper presents a new steganographic method called RSTEG (retransmission steganography), which is intended for a broad class of protocols that utilises retransmission mechanisms. The main innovation of RSTEG is to not acknowledge a successfully received packet in order to intentionally invoke retransmission. The retransmitted packet carries a steganogram instead of user data in the payload field. RSTEG is presented in the broad context of network steganography, and the utilisation of RSTEG for TCP (transmission control protocol) retransmission mechanisms is described in detail. Simulation results are also presented with the main aim of measuring and comparing the steganographic bandwidth of the proposed method for different TCP retransmission mechanisms, as well as to determine the influence of RSTEG on the network retransmission level.
---
paper_title: Steganography in IEEE 802.11 OFDM symbols

paper_content:

This paper presents a new steganographic method called wireless padding WiPad. It is based on the insertion of hidden data into the padding of frames at the physical layer of wireless local area networks WLANs. A performance analysis based on a Markov model, previously introduced and validated by the authors, is provided for the method in relation to the IEEE 802.11 a/g standards. Its results prove that maximum steganographic bandwidth for WiPad is as high as 1.1Mbit/s for data frames and 0.44Mbit/s for acknowledgment frames. To the authors' best knowledge this is the most capacious of all the known steganographic network channels. Copyright © 2011 John Wiley & Sons, Ltd.
---
paper_title: Techniques for data hiding

paper_content:

Data hiding is the process of embedding data into image and audio signals. The process is constrained by the quantity of data, the need for invariance of the data under conditions where the `host' signal is subject to distortions, e.g., compression, and the degree to which the data must be immune to interception, modification, or removal. We explore both traditional and novel techniques for addressing the data hiding process and evaluate these techniques in light of three applications: copyright protecting, tamper-proofing, and augmentation data embedding.
---

Title: Principles and Overview of Network Steganography

Section 1: INTRODUCTION
Description 1: Introduces the concept of network steganography, its importance in information protection, and its distinction from cryptographic methods.

Section 2: NETWORK STEGANOGRAPHY BASICS AND PRINCIPLES
Description 2: Discusses the fundamental principles and measures of effectiveness in network steganography, including potential throughput, resistance to steganalysis, and robustness.

Section 3: A CLASSIFICATION AND OVERVIEW OF NETWORK STEGANOGRAPHY TECHNIQUES
Description 3: Provides an overview and classification of various network steganography techniques, highlighting specific methods and their implementations across different OSI RM layers.

Section 4: CONCLUSIONS
Description 4: Summarizes the significance of understanding network steganography and its implications for future communication protocol design and network security.