Silence Speaks Volumes: A New Paradigm for Covert Communication via History Timing Patterns

TL;DR

This paper introduces a novel covert communication paradigm called History Covert Channels (HCC) that uses past network event timings to embed data, enhancing stealth and increasing transmission bitrate.

Contribution

The paper proposes a new HCC method utilizing relative timing pointers, reducing reliance on centralized clocks and improving robustness and undetectability.

Findings

Higher bitrate achieved compared to previous HCC methods

Reduced detectability through use of historical data references

Enhanced robustness of covert links

Abstract

A Covert Channel (CC) exploits legitimate communication mechanisms to stealthily transmit information, often bypassing traditional security controls. Among these, a novel paradigm called History Covert Channels (HCC) leverages past network events as reference points to embed covert messages. Unlike traditional timing- or storage-based CCs, which directly manipulate traffic patterns or packet contents, HCCs minimize detectability by encoding information through small pointers to historical data. This approach enables them to amplify the size of transmitted covert data by referring to more bits than are actually embedded. Recent research has explored the feasibility of such methods, demonstrating their potential to evade detection by repurposing naturally occurring network behaviors as a covert transmission medium. This paper introduces a novel method for establishing and maintaining covert communication links using relative pointers to network timing patterns, which minimizes the reliance of the HCC on centralized timekeeping and reduces the likelihood of being detected by standard network monitoring tools. We also explore the tailoring of HCCs to optimize their robustness and undetectability characteristics. Our experiments reveal a better bitrate compared to previous work.