## 2 Related Works  
In this section, we review the relevant literature on covert communication methods that can be embedded in several protocols for the IoT context. Several works have shown how out-of-band covert channels can be implemented in the IoT context [19]. For instance, light can be considered an effective carrier for exfiltrating data [20; 21] since it is possible to exploit the inability of the human eye to detect low-contrast and fast flickering images. Through this technique, plain LEDs, which are ubiquitous in IoT nodes and industrial equipment [22; 23; 24; 25], can also be used to build covert channels [26]. Instead, [27; 28] exploit smart bulbs to transmit covert channels by either modulating color, brightness, or power utilization. Different techniques are reported in [29; 30], where the authors investigate thermal covert channels that exploit heat emissions from components. Specifically, [29] demonstrate that by exploiting the core design principles of the BLE link-layer protocol combined with well-timed intensive CPU calculations, it is possible to mount a thermal covert channel between two devices. Additionally, [31; 32] focus on acoustic covert channels where devices use inaudible sound waves (for humans) to transmit data to microphones in the vicinity. Other covert channel techniques exploit the physical communication layer, i.e., they exploit the hardware and physical properties of a system to transmit hidden data outside the normal communication channels [33; 34; 35]. An example of these techniques can be found in [36; 37], where the authors show that radio frequency signals can be used to carry covert information. Similarly, in [38], the authors show that IEEE 802.15.4 links can also be used as steganographic carriers by hiding information in the direct spread spectrum sequence modulation. We observe that the limitation of these techniques lies in the fact that the transmission occurs over a short range; i.e., physical proximity to the device emitting the channel is required. A commonly adopted technique to create covert channels that can be exploited at the network level consists in manipulating packet timing and network traffic patterns to stealthily transmit data [39]. For instance, a covert channel can be built by altering the order of packets in a network stream, e.g., a given permutation of packet order could represent a binary value. This method exploits the fact that many network protocols are resilient to minor reordering, making the changes less noticeable [40]. On the other hand, the transmission rate of packets can be modulated to encode information. By switching between different data rates, a sender can embed covert signals within the timing of the packet flow [41]. For instance, a high transmission rate might represent a binary '1', while a low transmission rate represents a binary '0'. Additionally, intentional packet loss or manipulated data re-transmission of packets can be used as a means to build covert channels [42]. For instance, packets can be selectively dropped according to a predetermined pattern that in turn can be later decoded by the receiver. Alternatively, by triggering re-transmissions, a sender can embed information in the timing and frequency of these events. Alternative techniques to create covert channels consist of hiding data within the content of network packets [15; 16]. These techniques commonly leverage unused data fields in protocol headers, as well as other packet components, to embed hidden messages. For instance, at the IP level [43; 44], the identification field that is used for fragmenting packets can be used to transmit covert data without affecting the packet's delivery. Similarly, the type of service field can be used to embed covert data, since this field is rarely used in modern networks. Alternatively, TCP sequence numbers are used for tracking the order of packets [45; 46]. All these methods take advantage of common practices in network protocols which help covert channels to remain undetected.