IP covert timing channels: design and detection
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics