# Trends and Challenges in Network Covert Channels Countermeasures
## 1 Introduction
Therefore, covert channels are often addressed as a by-product outcome of the mitigation of apparently unrelated anomalous behaviors, the analysis and reverse engineering of a malware sample or the direct disclosure from the attacker [1; 2; 3; 4]. Thus, recognizing that a given deployment is exposed to steganographic communication attempts may be a challenging and poorly generalizable process. Nevertheless, development of countermeasures may lead to inefficient solutions based on the \"needle in the haystack\" principle possibly accounting for the indiscriminate penalization of traffic flows, the disruption of some protocol functionalities or the introduction of performance bottlenecks in the network. Despite the number of threats exploiting information hiding principles and covert channels to implement the various phases of an attack, the majority of research efforts focused on the investigation of how protocol ambiguities, poor design choices and flawed implementations of computing and communication frameworks can be used to covertly move information through the Internet. As a consequence, several reviews have been prepared (see, e.g., [1; 2; 8]) also by considering attacks targeting well-defined technological segments such as modern smartphones [9]. Alas, the specificities of the various embedding methods hindered the development of a coherent literature on countermeasures against network covert channels. In this perspective, the detection and neutralization of this class of threats have been never systematically organized or reviewed, with the notable exception of a partial discussion in [8], which dates back to 2007. Therefore, this paper aims at investigating trends and challenges characterizing the development of countermeasures against network covert channels, with the wide acceptation of tools, methodologies and algorithms aiming at detecting hidden communication attempts. We also include approaches intended for limiting or completely neutralizing the transmission capability of hidden communication paths laying within a network flow. The goals of this investigation are multiple. First, we want to understand if it is possible to delineate a clear trajectory in the literature aiming at counteracting network covert channels, or if the topic is addressed in a split and heterogeneous manner. Second, we aim at deriving some general guidelines or gaps to be filled to face challenges arising from the diffusion of stegomalware. Third, we intend to define some tradeoffs to be considered when designing countermeasures. Last, we want to show that, even if a relevant corpus of works on the topic exists, the attacker can easily evade preexistent mitigation approachesby moving to another protocol or slightly changing the injection method. To answer such research questions, we carried out a systematic review of the literature also by considering attacks and threats observed in the wild. The limit of this investigation is rooted within the very carrier-centric nature of hiding methods and countermeasures. In fact, the majority of works only proposes channel-specific mitigation mechanisms without further deepening generalizability aspects. Another consequence is that the research is ballkanized over different areas (e.g., information security, engineering and networking) often having incongruent definitions and thus accounting for overlaps or difficulties in retrieving ideas. Summing up, the main contributions of the paper are: (i) a review of the most recent approaches for counteracting network covert channels; (ii) the identification of the major research challenges and the most promising development trends; (iii) the discussion of advancements needed for elaborating a more coherent and unified framework for taming network covert channels and stegomalware. The remainder of the paper is structured as follows. Section 2 briefly introduces the background on network covert channels, while Section 3 discusses aspects to be considered when designing a mitigation approach.