Trends and Challenges in Network Covert Channels Countermeasures

Abstract

Network covert channels are increasingly used to endow malware with stealthy behaviors, for instance to exfiltrate data or to orchestrate nodes of a botnet in a cloaked manner. Unfortunately, the detection of such attacks is difficult as network covert channels are often characterized by low data rates and defenders do not know in advance where the secret information has been hidden. Moreover, neutralization or mitigation are hard tasks, as they require to not disrupt legitimate flows or degrade the quality perceived by users. As a consequence, countermeasures are tightly coupled to specific channel architectures, leading to poorly generalizable and often scarcely scalable approaches. In this perspective, this paper investigates trends and challenges in the development of countermeasures against the most popular network covert channels. To this aim, we reviewed the relevant literature by considering approaches that can be effectively deployed to detect general injection mechanisms or threats observed in the wild. Emphasis has been put on enlightening trajectories that should be considered when engineering mitigation techniques or planning the research to face the increasing wave of information-hiding-capable malware. Results indicate that many works are extremely specialized and an effective strategy for taming security risks caused by network covert channels may benefit from high-level and general approaches. Moreover, mechanisms to prevent the exploitation of ambiguities should be already considered in early design phases of both protocols and services.

A Revised Taxonomy of Steganography Embedding Patterns

“…(3) Adaptive Countermeasures. Current steganography countermeasures are usually tailored for testbed environments, where they provide sufficient results, see [4] for a comprehensive overview. However, not only do real-world applications demand very low false-positive rates as false-positives accumulate to large numbers for large-scale scenarios [31], they also have to deal with continuously changing data.…”

Code Augmentation for Detecting Covert Channels Targeting the IPv6 Flow Label

“…To prevent having a favorable setting, the content of messages have been randomly generated. This models an attacker who adopts an additional encryption layer or scrambling scheme to mimic the random nature of legitimate Flow Label values, in order to avoid statistical signatures that can make the detection easier [8]- [11].…”

“…As a consequence, detection and mitigation of network covert channels are prime tasks to fully address the security of modern network scenarios. Unfortunately, literature mainly focused on threats exploiting IPv4, hence leaving the IPv6 counterpart largely unexplored [6], [9]- [11]. Besides, the inspection process is often tightly coupled with the used information hiding method: this makes the detection poorly generalizable and could lead to non-negligible computational burdens (e.g., to check protocol fields via deep packet inspection [12]).…”

bccstego: A Framework for Investigating Network Covert Channels

“…The detection of a network covert channel is a nontrivial and poorly generalizable problem [4]. Spotting hidden communications within a bulk of network flows typically requires to implement attack-specific methodologies or to perform deep packet inspection, which poses scalability problems [9]. Moreover, security tools can not detect IPv6 covert channels out of the box [8], and many of them even have issues in handling IPv6 traffic as well as conversations exploiting v4/v6 transitional mechanisms [10].…”

“…The detection of covert channels targeting IPv6 is of prime importance today to fully assess security of modern network scenarios and to mitigate the advancement of stegomalware and other information hiding attacks [1][2][3]. Nevertheless, scalability of the approach should be considered as a design constraint, since inspection processes should not penalize legitimate traffic flows, e.g., by adding additional delays or disrupt the perceived Quality of Experience [1,4,9]. To this aim, we introduce bccstego, a framework that can be used for detecting network covert channels in the header of IPv6 packets.…”