A Network Steganography Lab on Detecting TCP/IP Covert Channels

Zseby, Tanja; Vazquez, Felix Iglesias; Bernhardt, Valentin; Frkat, Davor; Annessi, Robert

doi:10.1109/te.2016.2520400

Cited by 16 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We are currently developing a first open‐source version of the DAT software as well as a testbed for the generation of covert channels based on techniques described in the related literature. Moreover, we have already incorporated some of the introduced detection techniques in our ‘Network Security Advanced Laboratory’ at TU Wien , included in the academic program of electrical engineering students.…”

Section: Discussionmentioning

confidence: 99%

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

Iglesias

Annessi

Zseby

2016

Security Comm Networks

Self Cite

View full text Add to dashboard Cite

Covert channels provide means to conceal information transfer between hosts and bypass security barriers in communication networks. Hidden communication is of paramount concern for governments and companies, because it can conceal data leakage and malware communication, which are crucial building blocks used in cyber crime. We propose detectors based on descriptive analytics of traffic (DAT) to facilitate revealing network and transport layer covert channels originated from a wide spectrum of published data‐hiding techniques. DAT detectors transform communication data into flexible feature vectors that represent traffic by a set of extracted calculations and estimations. For the case of covert channels, the core of the detection is performed by the combined application of autocorrelation calculations and multimodality measures built upon kernel density estimations and Pareto charts. DAT detectors are devised to be embedded as extensions of network intrusion detection systems, being able to perform fast, lightweight analysis of numerous flows. The present paper focuses specifically on TCP/IP traffic and provides suitable classifications of TCP/IP fields and related covert channel techniques from the perspective of the statistical detection. The proposed methodology is evaluated with public traffic datasets as well as covert channels generated according to main techniques described in the related literature. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Discussionmentioning

confidence: 99%

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

Iglesias

Annessi

Zseby

2016

Security Comm Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…Recently, covert channels were employed by cyber-attacks, i.e., to permit a covert transmission of malware data. Nevertheless, they could also be applied for legitimate goals, such as transmitting illicit information under Internet censorship [ 14 , 98 , 107 ].…”

Section: Literature Reviewmentioning

confidence: 99%

“…to access sensitive information during data transmission. Therefore, demand is growing for intelligence and multimedia security studies that involve not only encryption, but also covert communication whose essence lies in concealing data [ 1 , 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 10 , 11 , 12 , 13 , 14 , 15 , 16 , 17 , 18 , 19 ]. Recently, information hiding or data hiding in digital texts, known as text hiding, has drawn considerable attention due to its extensive usage, and potential applications in the cybersecurity and network communication industries [ 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 , 28 , 29 , 30 , 31 , 32 , 33 , 34 , 35 , 36 , 37 , 38 , 39 , 40 , 41 , 42 , 43 , 44 , 45 , 46 , 47 , 48 , 49 , 50 , 51 , 52 ...…”

Section: Introductionmentioning

confidence: 99%

“…During the last two decades, many text hiding algorithms have been introduced in terms of text steganography and text watermarking for covert communication [ 1 , 6 , 8 , 9 , 10 , 11 , 12 , 13 , 14 , 20 , 31 , 36 , 39 , 51 , 91 ], copyright protection [ 3 , 4 , 5 , 7 , 18 , 20 , 21 , 22 , 23 , 24 , 25 , 26 , 27 , 28 , 29 , 44 , 49 , 50 , 51 , 52 , 53 , 54 , 55 , 56 , 57 , 58 , 59 , 60 , 61 , 62 , 63 , 64 , 65 , 66 , 67 , 68 , 72 , 73 , 74 , 75 , 87 , <...>…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Modern Text Hiding, Text Steganalysis, and Applications: A Comparative Analysis

Ahvanooey

Hou

et al. 2019

Entropy

View full text Add to dashboard Cite

Modern text hiding is an intelligent programming technique which embeds a secret message/watermark into a cover text message/file in a hidden way to protect confidential information. Recently, text hiding in the form of watermarking and steganography has found broad applications in, for instance, covert communication, copyright protection, content authentication, etc. In contrast to text hiding, text steganalysis is the process and science of identifying whether a given carrier text file/message has hidden information in it, and, if possible, extracting/detecting the embedded hidden information. This paper presents an overview of state of the art of the text hiding area, and provides a comparative analysis of recent techniques, especially those focused on marking structural characteristics of digital text message/file to hide secret bits. Also, we discuss different types of attacks and their effects to highlight the pros and cons of the recently introduced approaches. Finally, we recommend some directions and guidelines for future works.

show abstract

“…The research work proposed in [21] and [22] adopts a Support Vector Machine (SVM) technique proved to be highly effective to detect covert channels in comparison with other techniques. As the SVM is the best approach currently used for covert data channel detection, it was an obvious choice for us to compare our proposed algorithm against this type of detection approach in [21] in the context of ISNs.…”

Section: Comparison With Related Workmentioning

confidence: 99%

Efficient Non-Linear Covert Channel Detection in TCP Data Streams

et al. 2020

View full text Add to dashboard Cite

Cyber-attacks are causing losses amounted to billions of dollars every year due to data breaches and vulnerabilities. The existing tools for data leakage prevention and detection are often bypassed by using various different types of sophisticated techniques such as network steganography for stealing the data. This is due to several weaknesses which can be exploited by a threat actor in existing detection systems. The weaknesses are high time and memory training complexities as well as large training datasets. These challenges become worse when the amount of generated data increases in every second in many realms. In addition, the number of false positives is high which makes them inaccurate. Finally, there is a lack of a framework catering for the needs such as raising alerts as well as data monitoring and updating/adapting of a threshold value used for checking the data packets for covert data. In order to overcome these weaknesses, this paper proposes a novel framework that includes elements such as continuous data monitoring, threshold maintenance, and alert notification. This paper also proposes a model based on statistical measures to detect covert data leakages, especially for non-linear chaotic data. The main advantage of the proposed model is its capability to provide results with tolerance/threshold values much more efficiently. Our experiments indicate that the proposed framework has low false positives and outperforms various existing techniques in terms of accuracy and efficiency. INDEX TERMS Data leakage, network steganography, covert channel, TCP/IP protocol.

show abstract

A Network Steganography Lab on Detecting TCP/IP Covert Channels

Cited by 16 publications

References 12 publications

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

Modern Text Hiding, Text Steganalysis, and Applications: A Comparative Analysis

Efficient Non-Linear Covert Channel Detection in TCP Data Streams

Contact Info

Product

Resources

About