Automatic Detection of Storage-Based Covert Channels

Abstract

Network packets can be used to hide information in space or in time, a steganographic technique known as a covert channel. Steganalysis is the science of finding the presence of covert channels. Re-embedding steganalysis has been shown to be effective in detecting both the presence and the amount of hidden information. The technique, however, is impractical because it required manual analysis of every network flow. This paper proposes methods to automate the analysis process effectively. The experimental results suggest that automatic detection is possible and that re-embedding steganalysis is practical.