Countering Adaptive Network Covert Communication with Dynamic Wardens

TL;DR

This paper introduces a dynamic warden strategy to counter adaptive network covert channels, making it harder for hidden communication parties to succeed, with experimental validation showing its effectiveness.

Contribution

The paper proposes a novel dynamic warden approach that adapts over time to disrupt adaptive covert communication, advancing countermeasure strategies.

Findings

Dynamic wardens significantly reduce covert channel success rates.

Experimental results confirm the effectiveness of the proposed approach.

The approach complicates the inference process for covert communicators.

Abstract

Network covert channels are hidden communication channels in computer networks. They influence several factors of the cybersecurity economy. For instance, by improving the stealthiness of botnet communications, they aid and preserve the value of darknet botnet sales. Covert channels can also be used to secretly exfiltrate confidential data out of organizations, potentially resulting in loss of market/research advantage. Considering the above, efforts are needed to develop effective countermeasures against such threats. Thus in this paper, based on the introduced novel warden taxonomy, we present and evaluate a new concept of a dynamic warden. Its main novelty lies in the modification of the warden's behavior over time, making it difficult for the adaptive covert communication parties to infer its strategy and perform a successful hidden data exchange. Obtained experimental results indicate the effectiveness of the proposed approach.