A Survey of Network Covert Channel: Construction and Detection

Network covert channels facilitate the transmission of secret information in an undetectable manner. In this survey, we systematically study fundamental concepts, construction techniques, and detection methods of network covert channels. The channels are categorized into two types, namely, storage-based covert channels and timing-based covert channels. The former utilizes redundancy in protocol fields to embed information, while the latter transmits data by modulating traffic intervals. The timing-based channel primarily enhances concealment by adjusting the packet intervals and integrating protocol features, while the storage-based channel embeds information using redundant fields of each protocol layer. In terms of detection methods, timing-based channels are identified through statistical analysis of traffic patterns combined with machine learning models. Conversely, storage-based channels are typically uncovered by implementing protocol compliance verification and deep packet inspection of header fields and payload data. This survey investigates the evolution path of network covert channel construction and detection technologies in details, providing a theoretical foundation for the design of future network covert communication solutions.