We are very pleased to tell that the fundamentally revised version of the patterns-based taxonomy for steganography is now available on the new project website. A pre-print can be found here: https://doi.org/10.36227/techrxiv.20215373. The new taxonomy also incorporates the network-level hiding patterns from this website. Additionally, the new pre-print incorporates a revised version of the unified description method.
In an upcoming paper by Tobias Schmidbauer and Steffen Wendzel that will be presented at ASIA CCS 2022, patterns for indirect network covert channels are proposed.
The paper entitled SoK: A Survey Of Indirect Network-level Covert Channels is already available online through this link at ResearchGate. In the future, it should be also available through its DOI: 10.1145/3488932.3517418.
Abstract: Within the last few years, indirect network-level covert channels have
experienced a renaissance with new ideas and evolving concepts. Logical
network separation may now be crossed and the sending and receiving
activities can be performed with temporal distance between sending and
receiving operations. Despite these new developments, all indirect
network covert channels share certain basic principles that allow a
categorization. So far, the concepts of indirect network-level covert
channels have never been systematized. In this paper, we introduce a
taxonomy containing indirect covert channel patterns that allow a
differentiated analysis of all known indirect network-level covert
channels. We introduce additional definitions to unify the understanding
of the domain and further identify crucial features of indirect covert
channels to make them comparable and describable. We further discuss
application scenarios as well as potential and already evaluated
countermeasures against indirect covert channels. Further, we discuss
observable trends and anticipated future developments in the research
area of indirect network-level covert channels.
An upcoming publication [1] proposes a new pattern that exploits artificial reconnections. We already added it to the website as PT15 Artificial Reconnections.
Moreover, my (Steffen's) habilitation thesis is now available, its core topic are hiding patterns:
(links updated on Feb, 2nd)
The tool NeFiAS (Network Forensic & Anomaly Detection System) is an accessible hands-on tool for network covert channel detection. I just made the code of NeFiAS public. I also attached a documentation. Have fun with it!
