A novel distributed covert channel in HTTP

Abstract

In this paper, we propose a novel distributed covert channel in HTTP. Different from traditional covert channels in HTTP, the channel deploys multiple HTTP clients to dilute steganographic features. In a proper multiple-to-multiple transmission model based on the modulation of URLs, the channel is efficient and reliable. With a Poisson request generator, simulating behaviors of normal HTTP visitors, the covert traffic has a legitimate HTTP appearance that helps it be undetectable. The transmission experiments prove that the channel is error free and has a high transmission rate. The results of the undetectability experiment show that the channel is adjustable. By adjusting a certain parameter, the channel can trade off two different features, the transmission rate and the undetectability, which can meet different demands in practical applications.

Design and analysis of the covert channel implemented by behaviors of network users

“…Schulz et al , use the sequence number of the internet protocol security (IPSEC) authentication header or encapsulating security payload to transmit covert information. URLs in HTTP are modulated by to construct a distributed covert channel. Similarly, the average size of packets, the ratio of small and large packets, and the change of packet size patterns can act as carriers of the covert information .…”