# Trends and Challenges in Network Covert Channels Countermeasures
## 3 Development of Countermeasures  
The magic triangle relation can be considered as a prime conceptual device for driving the development of countermeasures against the various flavors of covert channels. In this vein, the seminal work of [PERSON] introduced the notion of _warden_, i.e., an entity responsible of spotting hidden communication attempts [14]. Specifically, [PERSON] modeled the threat by considering two prisoners wanting to orchestrate an escape plan by covertly exchanging details. The jail warden monitors such an exchange: if the attempt is spotted, prisoners will be confined. For the case of network covert channels, a warden can be a software or hardware entity able to collect and inspect network packets. Figure 1 depicts an intermediate node (denoted with a red box) acting as a warden. According to [15], different wardens exist and they can be classified by considering the type of information they use to detect the covert channel as well as their structure. Literature sill not agree on a unique taxonomy, but three main traits can be used to describe middleboxes and techniques for detecting hidden communication attempts exploiting network artifacts:  
* _functionality_: it denotes how the warden counteracts the covert channel. As it happens for other tools enforcing network security (e.g., firewalls or intrusion detection systems), a warden can be _stateless_ or _stateful_ depending on its ability of considering a packet at time or a burst of traffic, respectively. While the longer correlation of information can lead to improved performances, storing and processing huge traffic footprints may lead to unfeasible storage or computing requirements. If a warden only captures the traffic and acts on a private copy, it is considered _passive_. Otherwise, if it can manipulate, alter or drop packets, it is considered _active_. Lastly, a warden can be _static_ or _dynamic_, according to the ability of changing its policies during time or adapting against specific threats or network conditions. We point out that a warden can simultaneously have multiple functionalities, e.g., it can be static and stateless. * _knowledge_: it defines the type of information used by the warden to spot the presence of the channel. For instance, the warden can be aware of the exploited traffic or service (in this case, it is defined as _network-aware_) or totally _agnostic_. Moreover, it can know a priori the type of used embedding process or steganographic technique, or be engineered to only react against some specific patterns or threats. * _localization_: it defines where the warden has been placed to intercept the traffic and to monitor the network usage. Due to the evolution of devices and deployments, modern wardens should be capable to protect large network trunks and interact with multiple replicas as to provide scalability and detect the most sophisticated threats. Thus, a warden can act on a _local_ basis (e.g., on the device of the end user or his/her local network perimeter) or cover a vast geographical area. An emerging trend concerns the adoption of _distributed_ wardens, i.e., nodes able to gather the traffic in different portions of the network and cooperate to spot the covert channel. In the perspective of developing countermeasures against network cover channels, the ultimate goal of a warden is to neutralize steganographic threats laying within the legitimate traffic. To this aim, the first step is to perform the _detection_, i.e., become aware and identify the hidden communication path. This is a prerequisite for performing some further actions aimed at guaranteeing the security of network and computing infrastructures. Ideally, a warden should completely _eliminate_ the channel, but this is not always possible. For instance, this happens when impeding a specific channel will also disrupt some legitimate network services or penalize too much the quality perceived by users.