A Pattern-based Survey and Categorization of Network Covert Channel Techniques

Abstract

Network covert channels are used to hide communication inside network protocols. Within the last decades, various techniques for covert channels arose. We surveyed and analyzed 109 techniques developed between 1987 and 2013 and show that these techniques can be reduced to only 11 different patterns. Moreover, the majority (69.7%) of techniques can be categorized in only four different patterns, i.e. most of the techniques we surveyed are very similar. We represent the patterns in a hierarchical catalog using a pattern language. Our pattern catalog will serve as a base for future covert channel novelty evaluation. Furthermore, we apply the concept of pattern variations to network covert channels. With pattern variations, the context of a pattern can change. For example, a channel developed for IPv4 can automatically be adapted to other network protocols. We also propose the pattern-based covert channel optimizations pattern hopping and pattern combination. Finally, we lay the foundation for pattern-based countermeasures: While many current countermeasures were developed for specific channels, a pattern-oriented approach allows to apply one countermeasure to multiple channels. Hence, future countermeasure development can focus on patterns, and the development of real-world protection against covert channels is greatly simplified.

27 pages, 4 figures, 3 tables, accepted for publication in ACM Computing Surveys (CSUR, submitted on Dec-2013, accepted in Oct-2014). The final publication will be available via ACM

References in corpus (3)

• A Pattern-based Survey and Categorization of Network Covert Channel Techniques
• Multi-Level Steganography: Improving Hidden Communication in Networks
• Steganography using the Extensible Messaging and Presence Protocol (XMPP)

Cited by in corpus (12)

• A Pattern-based Survey and Categorization of Network Covert Channel Techniques
• Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses
• A Revised Taxonomy of Steganography Embedding Patterns
• Countering Adaptive Network Covert Communication with Dynamic Wardens
• DYST (Did You See That?): An Amplified Covert Channel That Points To Previously Seen Data
• A Survey of Internet Censorship and its Measurement: Methodology, Trends, and Challenges
• CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN
• Silence Speaks Volumes: A New Paradigm for Covert Communication via History Timing Patterns
• Domainator: Detecting and Identifying DNS-Tunneling Malware Using Metadata Sequences
• Protocol-independent Detection of "Messaging Ordering" Network Covert Channels
• Helol Tunnel: Covert Channel Exploitation of TLS Extensibility & Privacy Features
• Cross-Router Covert Channels