ProtoLeaks: A Reliable and Protocol-Independent Network Covert Channel

A multi-link network covert channel (MLCC) such as Cloak exhibits a high capacity and robustness and can achieve lossless modulation of the protocol data units. However, the mechanism of Cloak involving an arrangement of packets over the links (APL) is limited by its passive synchronization schemes, which results in intermittent obstructions in transmitting APL packets and anomalous link switching patterns. In this work, we propose a novel ordinal synchronization mark sequence (OSMS) for a Cloak framework based MLCC to ensure that the marked APL packets are orderly distinguishable. Specifically, a unidirectional function is used to generate the OSMS randomly before realizing covert modulation. Subsequently, we formulate the generation relation of the marks according to their order and embed each mark into the APL packets by using a one-way hash function such that the mark cannot be cracked during the transmission of the APL packet. Finally, we set up a retrieval function of the finite set at the covert receiver to extract the marks and determine their orders, and the APL packets are reorganized to realize covert demodulation. The results of experiments performed on real traffic indicated that the MLCC embedded with OSMS could avoid the passive synchronization schemes and exhibited superior performance in terms of reliability, throughput, and undetectability compared with the renowned Cloak method, especially under a malicious network interference scenario. Furthermore, our approach could effectively resist the inter-link correlation test, which are highly effective in testing the Cloak framework.

Download Full-text

A Survey of Key Technologies for Constructing Network Covert Channel

Security and Communication Networks ◽

10.1155/2020/8892896 ◽

2020 ◽

Vol 2020 ◽

pp. 1-20

Author(s):

Jing Tian ◽

Gang Xiong ◽

Zhen Li ◽

Gaopeng Gou

Keyword(s):

Communication Technology ◽

Network Architecture ◽

The Internet ◽

Covert Channel ◽

Free Access ◽

Transmission Network ◽

Information Channel ◽

Covert Channels ◽

Key Technologies ◽

Network Covert Channel

In order to protect user privacy or guarantee free access to the Internet, the network covert channel has become a hot research topic. It refers to an information channel in which the messages are covertly transmitted under the network environment. In recent years, many new construction schemes of network covert channels are proposed. But at the same time, network covert channel has also received the attention of censors, leading to many attacks. The network covert channel refers to an information channel in which the messages are covertly transmitted under the network environment. Many users exploit the network covert channel to protect privacy or guarantee free access to the Internet. Previous construction schemes of the network covert channel are based on information steganography, which can be divided into CTCs and CSCs. In recent years, there are some covert channels constructed by changing the transmission network architecture. On the other side, some research work promises that the characteristics of emerging network may better fit the construction of the network covert channel. In addition, the covert channel can also be constructed by changing the transmission network architecture. The proxy and anonymity communication technology implement this construction scheme. In this paper, we divide the key technologies for constructing network covert channels into two aspects: communication content level (based on information steganography) and transmission network level (based on proxy and anonymity communication technology). We give an comprehensively summary about covert channels at each level. We also introduce work for the three new types of network covert channels (covert channels based on streaming media, covert channels based on blockchain, and covert channels based on IPv6). In addition, we present the attacks against the network covert channel, including elimination, limitation, and detection. Finally, the challenge and future research trend in this field are discussed.

Download Full-text

A Novel Timing-based Network Covert Channel Detection Method

Journal of Physics Conference Series ◽

10.1088/1742-6596/1325/1/012050 ◽

2019 ◽

Vol 1325 ◽

pp. 012050 ◽

Cited By ~ 1

Author(s):

Shoupu Lu ◽

Zhifeng Chen ◽

Guangxin Fu ◽

Qingbao Li

Keyword(s):

Detection Method ◽

Covert Channel ◽

Channel Detection ◽

Covert Channel Detection ◽

Network Covert Channel

Download Full-text

Network covert channel analysis based on the density multilevel two segment clustering

2015 6th IEEE International Conference on Software Engineering and Service Science (ICSESS) ◽

10.1109/icsess.2015.7339051 ◽

2015 ◽

Author(s):

Xuyang ◽

Zouchenpeng ◽

Yangning

Keyword(s):

Covert Channel ◽

Channel Analysis ◽

Network Covert Channel

Download Full-text

Network Covert Channel Detection with Cluster based on Hierarchy and Density

Procedia Engineering ◽

10.1016/j.proeng.2012.01.639 ◽

2012 ◽

Vol 29 ◽

pp. 4175-4180 ◽

Cited By ~ 3

Author(s):

Qian Yuwen ◽

Song Huaju ◽

Song Chao ◽

Wang Xi ◽

Leng Linjie

Keyword(s):

Covert Channel ◽

Channel Detection ◽

Covert Channel Detection ◽

Network Covert Channel

Download Full-text

Research on Construction Methods for Network Covert Channels Based on HTTP

Applied Mechanics and Materials ◽

10.4028/www.scientific.net/amm.220-223.2528 ◽

2012 ◽

Vol 220-223 ◽

pp. 2528-2533

Author(s):

Ran Zhang ◽

Yong Gan ◽

Yi Feng Yin

Keyword(s):

Network Traffic ◽

Covert Channel ◽

Construction Technology ◽

Traffic Data ◽

Covert Channels ◽

Secret Data ◽

Construction Methods ◽

Working Principle ◽

Network Covert Channel

Network covert channel is a steganography technology that uses network traffic data as a carrier to transfer the secret data. This paper analyzes the working principle of network covert channels, and summarizes the commonly used construction technology of network covert channels. Then it analyzes the characteristics of the HTTP header lines and gives some methods of constructing network covert channels with these characteristics. Network covert channels based on the HTTP header lines are simple, flexible, and difficult to be detected and shielded.

Download Full-text