Synthetic Embedding of Hidden Information in Industrial Control System Network Protocols for Evaluation of Steganographic Malware

TL;DR

This paper presents a method to generate synthetic steganographic network data for industrial control systems, enabling efficient training and evaluation of defense mechanisms against hidden information attacks.

Contribution

It introduces a novel embedding concept that produces synthetic steganographic data rapidly, surpassing current methods, to improve cybersecurity defenses in ICS networks.

Findings

Synthetic data generation is faster than existing methods.

The approach effectively simulates steganographic embedding in ICS network protocols.

Enhanced training datasets improve detection of steganographic malware.

Abstract

For the last several years, the embedding of hidden information by steganographic techniques in network communications is increasingly used by attackers in order to obscure data infiltration, exfiltration or command and control in IT (information technology) and OT (operational technology) systems. Especially industrial control systems (ICS) and critical infrastructures have increased protection requirements. Currently, network defense mechanisms are unfortunately quite ineffective against novel attacks based on network steganography. Thus, on the one hand huge amounts of network data with steganographic embedding is required to train, evaluate and improve defense mechanisms. On the other hand, the real-time embedding of hidden information in productive ICS networks is crucial due to safety violations. Additionally it is time consuming because it needs special laboratory setup. To address this challenge, this work introduces an embedding concept to gene ate synthetic steganographic network data to automatically produce significant amounts of data for training and evaluation of defense mechanisms. The concept enables the possibility to manipulate a network packet wherever required and outperforms the state-of-the-art in terms of embedding pace significantly.