# Trends and Challenges in Network Covert Channels Countermeasures
## 2 Background  
As hinted, the adoption of some form of steganography to endow malware with stealthy capabilities has started more than a decade ago, mainly with threats using digital media as a diffusion vector or to exchange data containing configuration details (e.g., a list of IP addresses to be inspected or attacked) [1]. Instead, network covert channels have become popular more recently, as they offer to the attacker a wider palette of opportunities. First, a traffic flow is somewhat boundless, thus providing a carrier with few constraints compared to other software artifacts or digital media. Second, it is not uncommon to have network infrastructures with flows that last hours or days, thus allowing the malware to implement permanent hidden communication paths, for instance to support APTs or to orchestrate botnets [10]. In this perspective, Figure 1 depicts the reference scenario when addressing network covert channels and their detection. In more detail, we consider two covert endpoints (named as covert sender and covert receiver, respectively) wanting to remotely communicate in a hidden manner. To this aim, the legitimate, overt network flow is used as the carrier for containing the secret information. We point out that the two covert endpoints can be located in different portions of the network, thus implementing channels with different scopes. They can act in a Man-in-the-Middle manner as depicted in Figure 1 by eavesdropping a preexistent flow, or they can be colocated within the end nodes generating the overt traffic flow. Despite the placement of the communicating endpoints, two core classes of covert channels can be be created. They are characterized according to the steganographic approach used to embed the secret information. Specifically:  
* if the injection mechanism _directly embeds_ data within the carrier, a _storage network covert channel_ is created;
* if the injection mechanism manipulates the _timing_ of events or the _temporal evolution_ of the carrier, a _timing network covert channel_ is created. A general representation of the aforementioned approaches is depicted in Figure 1. A possible example of a storage channel is the one where the secret sender directly writes data in the unused bits available in the TCP header. For the case of a timing channel, the sender could encode information by modulating the delay experienced by two consecutive packets composing the flow, e.g., a delay greater than a given threshold value denotes a 1, otherwise a 0. As discussed in [11], the TCP/IP protocol architecture can be targeted with a variety of methods also by using many techniques or protocols simultaneously. Similar to other applications of steganography and information hiding, network covert channels are also characterized by the following three core metrics:  
* _steganographic bandwidth_ or _capacity_: the volume of secret data that can be sent per time unit by using a given embedding method;
* _undetectability_: the inability to detect the secret data within a certain carrier;
* _robustness_: the number of alterations that the hidden message can withstand before being destroyed. Obviously, the \"best\" covert channel should be robust and hard to detect, as well as able to provide the highest bandwidth. Unfortunately, it is not possible to maximize such properties at once, as they are tightly coupled via a _magic triangle_ rule [9; 12], i.e., it is not feasible to increase a performance index without lowering the remaining two. As an intuitive example, let us consider using some bits of an image as a method to embed secrets. Each alteration will lead to some noise, which must be kept under a suitable threshold to avoid detection or that the visual system can notice that some manipulations happened. In fact, the more bits that are used for the secret (the bandwidth increases), the more would be the noise or visual alterations, thus making the method more evident (detectable) [9].