PT2. Message Sequence Timing

Initial publication	W. Mazurczyk, S. Wendzel, S. Zander et al. in [2].
Illustration	Hidden data is encoded in the timing of message sequences, e.g. acknowledging every n'th received packet or sending commands m times.
Context	Network Covert Timing Channels -> Protocol-agnostic
Evidence	see [2]
Implementation

References:
[1] S. Wendzel, S. Zander, B. Fechner, C. Herdin: Pattern-based Survey and Categorization of Network Covert Channel Techniques, ACM Computing Surveys, Vol. 47, Issue 3, pp. 50:1-26, ACM, 2015.
An early version of the article is available here: download.

[2] W. Mazurczyk, S. Wendzel, S. Zander, A. Houmansadr, K. Szczypiorski: Information Hiding in Communication Networks, Wiley, 2016. Chapters 3 and 8 contain discussions on hiding patterns, basically on the basis of [1] but with an extension of timing-based patterns.