PaperlayerView exact revision on arXiv

Source-linked AI summary

A Pattern-based Survey and Categorization of Network Covert Channel Techniques

Steffen Wendzel, Sebastian Zander, Bernhard Fechner, Christian Herdin

arXiv:1406.2901v2cs.CR

TL;DR

Network covert-channel research lacks a comprehensive, current, protocol-independent catalog and often addresses individual techniques rather than shared characteristics. The paper analyzes 109 techniques with PLML-based patterns, introduces pattern variation, combination, and hopping, and finds that 69.7% fit four patterns while all techniques fit 11. Its pattern catalog supports novelty evaluation and pattern-oriented countermeasures, although pattern hopping requires reliable synchronization and the classification excludes normalization effects.

  • Problem

    Existing work lacks a comprehensive, current, protocol-independent catalog, while countermeasures commonly target individual covert channels rather than shared characteristics.

  • Method

    The authors analyze network covert channels using PLML-based patterns focused on shared abstract behavior, and introduce pattern variation, combination, and hopping.

  • Results

    109 surveyed techniques reduce to 11 patterns, with 69.7% categorized into four patterns.

  • Takeaways & Limitations

    The pattern catalog supports novelty evaluation and provides a basis for countermeasures that address multiple covert channels through generic patterns.

  • Takeaways & Limitations

    Pattern hopping requires reliable communication to prevent synchronization loss, and the classification does not account for normalization effects introduced by active wardens.

Abstract

from arXiv · show

Network covert channels are used to hide communication inside network protocols. Within the last decades, various techniques for covert channels arose. We surveyed and analyzed 109 techniques developed between 1987 and 2013 and show that these techniques can be reduced to only 11 different patterns. Moreover, the majority (69.7%) of techniques can be categorized in only four different patterns, i.e. most of the techniques we surveyed are very similar. We represent the patterns in a hierarchical catalog using a pattern language. Our pattern catalog will serve as a base for future covert channel novelty evaluation. Furthermore, we apply the concept of pattern variations to network covert channels. With pattern variations, the context of a pattern can change. For example, a channel developed for IPv4 can automatically be adapted to other network protocols. We also propose the pattern-based covert channel optimizations pattern hopping and pattern combination. Finally, we lay the foundation for pattern-based countermeasures: While many current countermeasures were developed for specific channels, a pattern-oriented approach allows to apply one countermeasure to multiple channels. Hence, future countermeasure development can focus on patterns, and the development of real-world protection against covert channels is greatly simplified.

1. INTRODUCTION

Network covert channels hide communication in network protocols, but existing classifications lack a comprehensive, current, protocol-independent catalog. The paper applies pattern-based categorization to organize techniques, assess novelty, adapt channels across protocols, and motivate pattern-oriented improvements and countermeasures.

  • Network covert channels hide communication in protocols when ordinary communication is too revealing and encryption alone is insufficient.
  • Existing work offers coarse categorizations, but no comprehensive and current catalog of network covert channel techniques.
  • The authors use PLML-based patterns to classify common abstract behavior and include covert channels published from 2009 to 2013.
  • 69.7% of surveyed techniques fit four patterns, while all 109 techniques fit 11 patterns, indicating substantial similarity among the techniques.
  • Pattern variation changes a channel’s network-protocol context without re-implementing its hiding technique.
  • Pattern combination can increase throughput, pattern hopping can increase stealthiness, and pattern-oriented countermeasures can target multiple techniques through generic patterns.

2. COVERT CHANNEL FUNDAMENTALS AND RELATED WORK

Network covert channels developed from local security-policy violations into techniques embedded in structured network carriers, including protocol fields and timing. Prior surveys and taxonomies leave gaps in hierarchy, recency, or practical pattern-based countermeasures, which this work addresses with a PLML taxonomy and related concepts.

  • Network covert channels encode hidden data in machine-interpretable network protocols, including structured carriers such as protocol headers.
  • Storage channels embed data in protocol fields, whereas timing channels encode data through packet timing, ordering, or inter-arrival gaps.
  • Network covert channels may generate traffic or piggyback on third-party traffic to increase covertness.
  • Prior classifications address local channels, list network techniques, or use entropy, but differ from this work’s hierarchical and technique-focused categorization.
  • The proposed PLML/1.1 taxonomy includes pattern variation, combination, and hopping, with hopping allowing adaptation when a pattern is blocked.
  • Pattern combination can apply multiple patterns to one PDU or a sequence of PDUs, while pattern hopping randomizes pattern use to improve stealthiness.

3. PATTERN-RELATED FUNDAMENTALS AND THEIR TAXONOMY USE

The paper introduces patterns and pattern languages as a basis for organizing covert-channel techniques. Patterns relate a recurring design problem to a solution in a given context, while PLML standardizes their descriptions for comparison and reuse.

  • Patterns document a recurring relation between a design problem, its solution, and the context in which that solution applies.
  • Patterns support readable collaboration, capture established design knowledge, and allow different implementations to satisfy the same general requirements.
  • Pattern catalogs collect related patterns within a common domain, while pattern languages organize such catalogs into a domain-specific structure.
  • PLML standardizes pattern schemes with XML tags, addressing inconsistent descriptions that make patterns difficult to search and reference across catalogs.

4. CLASSIFICATION OF COVERT CHANNEL PATTERNS BY USING PLML

The authors use PLML to classify surveyed covert-channel techniques into a hierarchical catalog of abstract patterns. Their evaluation covers 109 techniques selected from prior surveys and additional influential or novel publications.

  • 109 evaluated covert-channel techniques were classified into 11 abstract patterns.
  • The survey combines techniques referenced by three existing surveys with additional highly cited or novel papers published between 2009 and 2013.
  • The catalog merges literature and evidence information into a streamlined pattern presentation and removes redundant or irrelevant PLML attributes.
  • The catalog includes author-proposed hiding techniques when fewer than three literature use cases existed for a pattern.
  • The catalog illustrates techniques that modify protocol structure by changing element order, PDU size, element count, or element position.

P3. Add Redundancy Pattern:

The Add Redundancy pattern creates additional space or signaling opportunities in protocol headers and PDUs to carry hidden information. Its variants include inserting data-bearing elements and exploiting corruption or packet loss.

  • The Add Redundancy pattern creates new space within a header element or PDU for hiding data.
  • Example techniques add IPv4 options, IPv6 destination options, extended HTTP or SMTP headers, pointer and length manipulations, or random bytes to SSH messages.
  • A related variant generates corrupted protocol data units or deliberately uses packet loss to signal hidden information.
  • Examples include corrupted broadcast or IEEE 802.11 frames and selected packet drops between VPN sites by a man-in-the-middle adversary.

P5. Random Value Pattern:

The Random Value pattern hides information by selecting among permitted values of protocol attributes, including identifiers, timing-related fields, addresses, protocols, ports, and character case. The paper notes that values expected to follow contextual distributions may make such channels detectable.

  • Examples use IPv4 identifiers, TCP initial sequence numbers, DHCP transaction fields, timestamp-related fields, and least significant bits of protocol attributes.
  • Values such as TCP ISNs may follow operating-system or contextual distributions, so inserting random values can produce detectable distribution changes.
  • The Random Value pattern encodes hidden information by selecting one of n values available to a header element.
  • Other variants select among Ethernet addresses, TTL or Hop Limit values, application protocols or ports, and case forms in HTTP, XMPP, SMTP, POP3, or NNTP.

P7. Reserved/Unused Pattern:

The Reserved/Unused pattern encodes hidden data in undefined or reserved protocol elements, with examples spanning data-link and IP headers.

  • P7. Reserved/Unused Pattern:: Reserved or unused bits and fields in protocol headers can carry hidden data.Examples include IEEE 802.5 frame bits, IPv4 fields, and IPv6 header or extension-header fields.
  • P7. Reserved/Unused Pattern:: The surveyed examples apply the pattern across multiple network protocols and protocol layers.The evidence lists data-link-layer frames, IPv4, and IPv6 mechanisms.
  • P7. Reserved/Unused Pattern:: Timing-channel examples encode hidden information by altering intervals between network PDUs.The listed mechanisms include changing LAN-frame timing, HTTP response time, BACnet/IP packet timing, and SSH inter-arrival delays.

P9. Rate Pattern:

The Rate Pattern encodes hidden information by changing the data rate of a traffic flow between a sender, receiver, or third party.

  • P9. Rate Pattern:: The Rate Pattern alters a traffic flow’s data rate to transmit hidden information.The altered flow may run from the covert sender or a third party to the covert receiver.
  • P9. Rate Pattern:: A covert sender can affect throughput by exhausting switch performance or manipulating serial-port control commands.The examples use switch performance and delayed Clear to Send/Ready to Send commands as rate-control mechanisms.
  • P9. Rate Pattern:: The pattern can also directly alter the data rate of a legitimate channel between covert sender and receiver.This preserves the legitimate channel as the flow whose rate carries the hidden information.

P10. PDU Order Pattern:

The PDU Order Pattern encodes hidden data by arranging a chosen sequence of protocol data units between covert sender and receiver.

  • P10. PDU Order Pattern:: The PDU Order Pattern uses a synthetic PDU order to encode data for a specified number of flowing PDUs.The encoded order is constructed for communication between the covert sender and receiver.
  • P10. PDU Order Pattern:: Examples modify the order of IPSec Authentication Header, Encapsulated Security Payload, and TCP packets.These examples apply ordering changes to different packet types and protocols.
  • P10. PDU Order Pattern:: A man-in-the-middle adversary can reorder VPN traffic between MitE systems to signal hidden data to both adversaries.The example uses packet-order manipulation between two VPN-secured sites.

P11. Re-Transmission Pattern:

The paper organizes covert-channel techniques into hierarchical patterns and finds that 76 of 109 techniques belong to four patterns. The catalog also defines structural distinctions and acknowledges scope limitations in its analysis.

  • Taxonomy and classification: The hierarchy organizes patterns into categories and permits a pattern to be a child of another pattern.The hierarchy is visualized with categories and patterns, and the Case pattern is given as a child-pattern example.
  • Taxonomy and classification: The major categorization divides channels into timing and storage, with storage channels further divided by payload use and PDU structure.The analysis excludes storage channels that hide information in payload and distinguishes non-payload channels that change or preserve PDU structure.
  • Taxonomy and classification: Structure-modifying patterns alter header-element order or PDU size, whereas structure-preserving patterns modify a PDU data element.The distinction applies to the organization of storage-channel patterns.
  • Limitations: The analysis does not account for normalization effects that active wardens can introduce into many patterns.Examples include removing IPv4 options used to carry hidden data; timing channels and modified fields are treated as noisy under stated conditions.
  • Occurrence rate: 76 of 109 techniques, or 69.7%, are based on four patterns: Reserved/Unused, Add Redundancy, Value Modulation, and Random Value.The four patterns account for 24, 21, 21, and 10 techniques respectively; Value Modulation includes Case and LSB child patterns.
  • Limitations: The literature occurrence of patterns cannot be compared with practical use rates because usage-rate information is unavailable.The authors identify this comparison as interesting but unsupported by available information.

5. VARIATION OF COVERT CHANNEL PATTERNS

The paper defines pattern variation as automatically adapting a covert-channel pattern to a different network-protocol context. It also proposes combining or hopping between patterns to support different throughput, stealth, reliability, and blocking conditions.

  • Pattern variation: Pattern variation adapts a covert-channel pattern to a new network protocol, such as changing an IPv4-based channel for IPv6.The adaptation is intended to be automatic for both sender and receiver, generating code for the altered context instead of requiring programming from scratch.
  • PLML-based pattern variation: Pattern-specific settings encode protocol-dependent information such as bit offsets, field lengths, allowed values, packet limits, and timing or rate constraints.Examples include protocol-specific field locations and sizes, TCP first-packet restrictions, value ranges, inter-packet timing, and packet-rate limits.
  • PLML-based pattern variation: The Random Value pattern can use IPv4’s 16-bit Identifier field or TCP’s 32-bit ISN, with an OnlyFirstPkt restriction for TCP because the ISN is random only in the first packet.Dependent header-field calculations, such as IPv4 checksums and length fields, still require additional tools such as scapy.
  • Pattern combination and hopping: Pattern variation also supports situational requirements, such as using different settings when a covert video stream needs higher throughput than a password transfer.The paper presents pattern combination and pattern hopping as approaches using multiple patterns rather than multiple individual hiding techniques.
  • Pattern combination and hopping: Pattern hopping can switch between patterns when one is administratively blocked, while reliable communication and micro protocols help prevent packet-loss-induced CSPRNG desynchronization.Pattern combination can apply multiple patterns in parallel to one packet or sequentially to subsequent packets.

6. COUNTERMEASURES

The paper examines countermeasures according to covert-channel patterns rather than isolated techniques. This pattern-oriented view can cover multiple channels, but protocol-specific effectiveness may require adapting countermeasures to each network context.

  • Countermeasure scope: Existing protection approaches aim to eliminate covert channels, limit their capacity, or detect them, but countering all techniques is difficult in practice.Previous approaches generally targeted selected covert channels in particular network protocols.
  • Pattern-oriented protection: Pattern-based countermeasures can address sets of hiding techniques linked to the same pattern, reducing the number of protection mechanisms needed for the 109 techniques represented by 11 patterns.The paper presents this as a more practical alternative to developing separate countermeasures for individual channels.
  • Countermeasure limitations: General pattern-based countermeasures may be less effective than specialized ones, because protocol-specific value distributions can reduce detection accuracy after direct adaptation.Therefore, pattern-based countermeasures themselves require variation for particular network protocols.
  • Traffic normalization: Traffic normalization already provides pattern-oriented capabilities, including clearing unused fields, fixing decreasing fields, and correcting or dropping packets with dependent fields.Examples include fixed TTL or hop-limit values for LSB and Value Modulation patterns and handling checksum-related fields for PDU Corruption/Loss.
  • Countermeasure variation: A normalizer that fixes IPv4 TTL values can be adapted to IPv6 hop limits and BACnet hop counts, countering the LSB pattern across protocol variations without a new technique.The paper uses this as an example of countermeasure variation across network protocols.

7. CONCLUSION

The study reduces 109 network covert channel techniques to 11 hierarchical PLML patterns, with most techniques represented by only four patterns. It extends the catalog with pattern variation and optimization concepts while identifying practical countermeasure development as future work.

  • 109 techniques were represented by 11 abstract patterns arranged in a hierarchical catalog based on PLML.
  • Most surveyed techniques can be reduced to only four patterns, indicating substantial similarity among them.
  • Pattern variation enables a generic hiding technique to adapt automatically to different network protocols without re-implementation.
  • Pattern hopping and pattern combination were introduced to improve covert-channel throughput and stealthiness.
  • Pattern-based countermeasure implementation and practical evaluation remain important future work.
  • Future work also includes PLML-based catalogs for local covert channels and payload-based hiding techniques.
Loading 1406.2901v2…