# Trends and Challenges in Network Covert Channels Countermeasures
## 1 Introduction  
Information hiding and steganographic techniques are becoming widely used by attackers to avoid detection and remain unnoticed for a large amount of time [1]. For instance, they have been used to conceal the presence of a malware within innocent looking pictures, to hide malicious code or additional functionalities with the aim of implementing covert multi-stage loading architectures, as well as to exfiltrate secret information in Advanced Persistent Threats (APTs) [2, 3]. As a consequence of the versatility of information hiding mechanisms, a new-wave of malware endowed with steganographic capabilities (named _stegomalware_) has been observed in the wild and the trend is expected to grow in the near future [1, 4]. One of the most popular and effective uses of information hiding to support insecurity concerns the creation of _covert channels_, i.e., hidden communication paths allowing two peers to exchange data. According to [PERSON], covert channels are \"_not intended for information transfer at all, such as the service program's effect on the system load_\" [5]. Literature proposes a wide array of scenarios and mechanisms for creating hidden communication paths between a variety of software and hardware entities. As possible examples of endpoints wanting to secretly exchange data, we mention: cloud-based and softwarized services, containers and virtual machines and multi-core or multi-CPU frameworks. Despite the nature of the specific target, a covert channel can be generally linked to an imperfect isolation, i.e., state information or a specific behavior of a software or hardware element is leaked outside the intended functional perimeter [6]. To create a covert channel, the two secret endpoints must agree on a steganographic/hiding scheme, which acts as the pre-shared secret. The secret information is then embedded into acarrier_. To this aim, different methodologies can be used and various hardware or software artifacts can be exploited for storing arbitrary data. For instance, the secret can be directly embedded in the metadata of a file or properly encoded by manipulating some temporal evolution such as the load offered to the CPU. Even if complex encoding and embedding strategies exist, the totality of covert channels can be reduced to a set of well-defined patterns, such as the modulation of some structural properties (e.g., the size of a file) or the introduction of artificial transmission errors [7]. Concerning carriers that can contain the secret information, network flows are becoming quickly the most preferred one used by attackers. Accordingly, the produced hidden communication paths are named _network covert channels_. As possible examples, channels can be built by injecting data in unused protocol fields as well as by modulating some behaviors of the flow like the throughput or the inter packet time (see, e.g., [8] for a survey on the topic). As a consequence, the investigation of security risks caused by network covert channels has quickly become of paramount importance. In fact, network covert channels have proven to be an effective tool to support several malicious activities. Specifically, they have been used for exfiltrating stolen confidential data (e.g., login credentials), to orchestrate nodes of a botnet, to implement multi-stage loading architectures to retrieve attack routines (e.g., by embedding malicious code in innocent-looking images), to launch commands for configuring backdoors and to support industrial espionage campaigns [1; 2; 9]. Unfortunately, modern scenarios offer a wide range of protocols, software entities and hardware devices that can be used to contain secret information [7; 8]. This grants the attacker huge advantages over the defender and the deployment of countermeasures against a specific steganographic threat seldom happens a priori.