PT12. Re-Transmission Pattern (also P11)

Initial publication	S. Wendzel, S. Zander, B. Fechner, C. Herdin in [1]
Illustration	A covert channel re-transmits previously sent or received PDUs.
Context	Network Covert Timing Channels -> Protocol-aware
Evidence	C. Kraetzer, J. Dittmann, A. Lang, and T. Kuehne. 2006. WLAN Steganography: A First Practical Review. In Proc. 8th Workshop on Multimedia and Security (MMSEC’06). 17–22. S. Zillien, S. Wendzel: Detection of Covert Channels in TCP Retransmissions, in Proc. NordSec 2018, Springer, 2018. See [1] for two additional examples of such hiding techniques based on the re-transmission pattern.
Implementation	?
Known Pattern-based Countermeasures	S. Zillien, S. Wendzel: Detection of Covert Channels in TCP Retransmissions, in Proc. NordSec 2018, Springer, 2018.

References:
[1] S. Wendzel, S. Zander, B. Fechner, C. Herdin: Pattern-based Survey and Categorization of Network Covert Channel Techniques, ACM Computing Surveys, Vol. 47, Issue 3, pp. 50:1-26, ACM, 2015.
An early version of the article is available here: download.