Network Steganography Countermeasures

Abstract

This chapter discusses the countermeasures available against network steganography. This includes measures that target a control protocol and it also includes measures against watermarking, a specific application of network steganography. Countermeasures can be active or passive techniques, or a combination of both. How to deal with network steganography greatly depends on the security requirements of organizations and government policies, the applications for which the covert channels are used, and the countermeasures available in practice. A number of channels created using storage methods can be eliminated by traffic normalization. Storage methods that cannot be eliminated and most timing methods can be countered by limiting the capacity of the covert channel. Machine learning methods have been shown to be very effective to detect covert channels-both storage and timing methods. Many covert channels use control protocols, which can also be exploited to eliminate, limit, or detect the covert channel.