Analysis of Reversible Network Covert Channels

Abstract

In the last years, the utilization of information hiding techniques for empowering modern strains of malware has become a serious concern for security experts. Such an approach allows attackers to act in a stealthy manner, for instance, to covertly exfiltrate confidential data or retrieve additional command & control payloads for the operation of malware. Therefore, the deep understanding of data hiding mechanisms is a core requirement, as it allows designing effective countermeasures. Unfortunately, the most recent evolution of information-hiding-capable threats enjoys reversible properties, i.e., the abused network flow is restored to its original form. Hence, detection approaches based on the comparison of different traffic samples may not work anymore. In this paper, we further investigate various methods for performing reversible data hiding for network covert channels. Specifically, we extend our previous research by considering different scenarios focusing on IPv4 traffic and HTTP conversations. The results confirm that reversibility can be used in various network conditions and is not impaired by middleboxes. In addition, engineering countermeasures or mitigation techniques could be difficult, thus requiring to consider reversible mechanisms already in the early design stages of a protocol/deployment.

A Generic Taxonomy for Steganography Methods

“…No Consideration of reversibility and indirect hiding methods: As previous taxonomies, we did not cover the aspect of reversibility for hiding patterns. While some works have already analyzed reversibility for digital media steganography [174]- [176] as well as for network steganography [177], [178], we leave such a large analysis for future work as it requires excessive experimental evaluations which are not within the scope of a survey paper. Similarly, we do not present patterns or discussions on indirect hiding methods as a recent paper already provides a survey on these [16].…”