# Trends and Challenges in Network Covert Channels Countermeasures
## 6 Trends and Challenges  
The growing adoption of covert channels as a paradigm to empower stegomalware and support data exfiltration is expected to persist in the future [1]: new attacks will be more sophisticated, cross-layer and able to leverage the complex interplay of hardware and software components [52]. This will magnify the gap between the attacker and the defender, especially in terms of uncertainty of what to inspect and where to place wardens within the overall network architecture. Reviewed countermeasures as well as tools deployed in the wild seem only partially trying to mitigate such an aspect. Thus, the main trends in the development of countermeasures observed and the challenges to be faced are:  
* **generalization**: data gathering as well as detection and sanitization of network covert channels may require to deploy a wide range of collection techniques and to inspect several heterogeneous carriers [2]. As regards the collection phase, literature show-cased the use of in-kernel mechanisms to analyze the various carriers exploited to set local covert channels (see, e.g., [25] for the use of the extended Berkeley Packet Filter to spot stealth data exchange via alteration of Unix file permissions). Future wardens should be able to exploit similar techniques to have general filters that can be stacked up when the used carrier is uncertain or impossible to isolate a priori. Moreover, performing kernel-level analysis could help in avoiding bottlenecks or mitigating overheads causing legitimate flows to experience additional delays;
* **abstraction**: future channels are expected to target different parts of modern network ecosystems, such as appliances and IoT nodes. In this vein, network covert channels will be able to use a multitude of carriers, mainly characterized by a very composite set of protocols, sensors and architectural blueprints. In this perspective, an interesting approach concerns the development of more abstract metrics, which can be used to spot the steganographic attack despite the used carrier. Literature demonstrated that process correlation [61] or anomalous energy consumption and drains [62; 63] are excellent candidates to make the detection more threat-independent. To pursue such a vision, the detection could need to be shifted towards the border of the network or close to users. This poses several challenges, for instance in terms of avoiding performance degradation of devices of end users and additional security requirements;
* **cloud**: without doubts, cloud infrastructures will remain a relevant component of the future Internet. There are many works highlighting that covert channels are progressively used to attack virtualized environments mainly to let virtual machines to collude and evade security frameworks (see [64] for a review on the topic). Concerning network covert channels, recent investigations showcased how cloud architectures can be abused to set up Internet-wide communication paths [65]. As a consequence, cloud and virtualized environments should be protected against information-hiding-capable threats [66] and data breaches orchestrated via network covert channels;
* **everything-as-a-service**: as shown, being able to detect covert channels may require a non-negligible amount of storage (e.g., to store traffic dumps or datasets) and computing power (e.g., to compute metrics or run machine-learning-capable frameworks). Being able to deploy wardens for protecting large-scale networks or running sophisticated detection software while delivering satisfactory performances could be unfeasible for small-medium actors. Therefore, a relevant effort should be done to explore Warden-as-a-Service approaches [3; 4];
* **reversibility**: in reversible network covert channels, the two secret endpoints communicating are able to \"restore\" the traffic to its original form (i.e., before the injection of the hidden data) in order to avoid detection [67; 68].