A survey of covert channels and countermeasures in computer network protocols

By Sebastian Zander, Grenville J. Armitage, Philip Branch. IEEE Communications Surveys and Tutorials, 2007

588 citations recorded by the source corpus.

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1f83189529b068e118c3bc4cc1323b56c8d4cf64

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Covert Communications: A Comprehensive Survey (2023, background): “Although a few surveys aim to illustrate the covert channels [119], [120], [121], [122], the covert communications is not well surveyed in the existing literature.”
Security and Privacy for 6G: A Survey on Prospective Technologies and Challenges (2021, background): “More detail of covert channel countermeasures can be found at [115].”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, background): “A covert channel tries to hide the very existence of any communication [Lampson 1973; Zander et al. 2007] by using a channel that is usually not intended for communication (e.g., timing information in between packets or unused bits in the IP header).”
Packet Chasing: Spying on Network Packets over a Cache Side-Channel (2019, unknown): “Many of these covert channels are based on non-standard or abnormal behaviour of the protocol and can be detected and prevented by simple anomaly detection methods [11].”